ReadMe STEP7 Professional V14 enUS PDF

Readme
Programming and Operating Manual
09/2016
Notes on the TIA Portal
STEP 7 Professional
WinCC Basic
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will be
used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to property
damage.
Qualified Personnel
The product/system described in this documentation may be operated only by personnel qualified for the specific
task in accordance with the relevant documentation, in particular its warning notices and safety instructions. Qualified
personnel are those who, based on their training and experience, are capable of identifying risks and avoiding
potential hazards when working with these products/systems.
Proper use of Siemens products

Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended or
approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and
maintenance are required to ensure that the products operate safely and without any problems. The permissible
ambient conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
All names identified by are registered trademarks of Siemens AG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software described.
Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the information in
this publication is reviewed regularly and any necessary corrections are included in subsequent editions.
Siemens AG
Division Digital Factory
Postfach 48 48
90026 NRNBERG
GERMANY
09/2016 Subject to change
Copyright Siemens AG 2016.

All rights reserved
Table of contents
1
Notes on the TIA Portal................................................................................................................................5

1.1
General notes...........................................................................................................................5
1.2
Notes on libraries.....................................................................................................................7
1.3
Notes on memory cards...........................................................................................................7
1.4
Notes on the hardware configuration.......................................................................................8
1.5
Notes on instructions................................................................................................................9
1.6
Notes on using the TIA Portal in a virtual environment (private cloud)....................................9
STEP 7 Professional..................................................................................................................................11
2.1
Security information...............................................................................................................11
2.2
Notes on use..........................................................................................................................12
2.3
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.9
2.3.10
2.3.11
2.3.11.1
Editing devices and networks.................................................................................................14

General information on devices and networks.......................................................................14
Use of modules on the S7-1200.............................................................................................14
CP 343-2 on SIMATIC S7 Embedded Controller EC31-RTX.................................................15
F-CM AS-i Safety ST for ET 200SP.......................................................................................16
S7 routing via IE/PB Link.......................................................................................................16
Notes on the S7-1500 Web server.........................................................................................16
Notes on Secure Open User Communication........................................................................17
Deactivating SNMP (S7-1200, S7-1500)...............................................................................17
Amendment to description of "Configuring multiple rings".....................................................19
Notes on online and diagnostics............................................................................................19
Network components.............................................................................................................20
Network components.............................................................................................................20
2.4
2.4.1
2.4.2
2.4.3
2.4.3.1
2.4.3.2
2.4.4
2.4.4.1
2.4.4.2
Programming a PLC...............................................................................................................24
General notes on PLC programming.....................................................................................24
Instructions.............................................................................................................................26
Testing the user program.......................................................................................................29
Testing with the watch table...................................................................................................29
Testing with the force table....................................................................................................30
Compatibility of PLC programs from older versions...............................................................30
Compatibility of PLC programs from versions prior to V14....................................................30
Compatibility of PLC programs from versions prior to V13.1.................................................35
2.5
2.5.1
Inter Project Engineering (IPE)..............................................................................................40

Notes on IPE..........................................................................................................................40
2.6
2.6.1
2.6.2
2.6.3
2.6.4
2.6.4.1
Technological functions..........................................................................................................41
Notes on technological functions...........................................................................................41
SIMATIC STEP 7 Easy Motion Control..................................................................................47
Notes on SIMATIC STEP 7 Easy Motion Control..................................................................47
Readme
Programming and Operating Manual, 09/2016
Table of contents
2.6.5
2.6.5.1
3
SIMATIC STEP 7 PID Professional.......................................................................................48

Notes on SIMATIC STEP 7 PID Professional........................................................................48
WinCC Basic..............................................................................................................................................49
3.1
Security information...............................................................................................................49
3.2
News......................................................................................................................................50
3.3
Notes on use..........................................................................................................................51
3.4
Migration................................................................................................................................52
3.5
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
Engineering System...............................................................................................................54
Screens and Screen Objects.................................................................................................54
Tags and connections............................................................................................................58
Alarm system and alarm displays..........................................................................................59
System functions....................................................................................................................60
Recipes..................................................................................................................................60
User administration................................................................................................................61
Communication......................................................................................................................61
3.6
System-wide functions...........................................................................................................63
3.7
Compiling and loading............................................................................................................64
3.8
3.8.1
3.8.2
Runtime..................................................................................................................................66
Notes on operation in Runtime...............................................................................................66
Notes on operation of panels in Runtime...............................................................................68
3.9
3.9.1
HMI devices...........................................................................................................................69
Notes on HMI devices............................................................................................................69
Index...........................................................................................................................................................73
Readme

1.1
General notes
The information in this readme file supersedes statements made in other documents.
Read the following notes carefully because they include important information for installation
and use. Read these notes prior to installation.
Importing and exporting CAx data

Contrary to the information in the online help, it is not possible to export and import CAx data.
Upgrading from TIA Portal V13 SP1 projects with master copies from TIA Portal V10.5
Before upgrading a project, check if the master copies created with TIA Portal V10.5 are
contained in its project library. This is necessary, for example, when you receive a message
during the upgrade about an S7-1200 CPU with firmware version V1.0 used in the project,
even though you have not configured such a CPU. The CPU is a master copy in the project
library in this case.
Before upgrading a project with master copies from TIA Portal V10.5, therefore, do the
following:
1. Use each master copy created with the TIA Portal V10.5 once in the project.
2. Delete the affected master copies from the project library.
3. Create the master copy again with the objects from the project.
4. Save the project in TIA Portal V13 SP1.
You can then upgrade the project to the latest version.
Display of Asian characters in the TIA Portal

Due to a change in behavior in Microsoft Windows, it may occur that texts are not displayed
correctly in the TIA Portal when a Chinese TIA Portal is installed on another Asian operating
system (e.g. Korean). To view the texts in TIA Portal correctly, open the Windows Control
Panel and select "English" under "Language for non-Unicode programs". Note, however, that
this may cause display problems in other programs.
Installing new .Net versions or .Net service packs

Close the TIA Portal before installing a new .Net version or a new .Net service pack on your
programming device/PC.
Restart the TIA Portal only after successful installation of the new .Net version or the
new .Net service pack.
Readme

1.1 General notes
Notes on handling
If a project in the list of projects last used is located on a network drive that is not connected,
you may experience delays when opening the "Project" menu.
When you insert a CPU, you may need to wait for some time if the project editor is open at
the same time. This generally takes longer when you insert the first CPU in a newly created
project. To be able to continue working at a good pace, you should close the project text
editor before inserting a CPU.
The alarm "Application is not responding" may appear in Windows 7 with functions that
take a long time to run (loading the CPU for example). If this occurs, wait until the function
has correctly finished.
If you have installed a Microsoft mouse with IntelliPoint, you may find that it superimposes
components over the buttons of the title bar. If this is the case, uninstall the IntelliPoint
software from Microsoft.
Enabling the "Virtual Desktop" options with NVIDIA graphics cards can cause problems. In
this case, disable the "nView virtual desktop manager" of your NVIDIA graphics driver.
Working with automatically synchronized network drives

A TIA Portal project consists of multiple files that are saved together in one directory. If you
store a project that is automatically synchronized on a network drive or in a cloud directory
(e.g. Dropbox, Syncplicity or GoogleDrive), this can lead to data loss if the synchronization
only takes place partially or asynchronously. For this reason, we do not recommend editing
TIA Portal projects directly on synchronized network drives or in cloud directories. Always close
the TIA Portal project before synchronization and make sure that all directories and files from
the project directory are synchronized together and completely. You may wish to disable
automatic synchronization while working with the TIA Portal. The synchronization itself must
be implemented in such a way that the current (local) project data replaces the project data
on the network drive or in the cloud directory.
Entry of decimal places

With certain Windows language settings, it may occur that the entry of values with a comma
as decimal place is not recognized (entering "1,23" leads to an error). Instead, use the
international format ("1.23").
Information on the TIA Portal in online support

Overview of the most important technical information and solutions for the TIA Portal in the
Siemens Industry online support.
Internet link: TIA Portal in Siemens Industry online support (https://
support.industry.siemens.com/cs/ww/en/view/65601780)
All information on service and support in the Siemens Industry online support:
Internet link: Service and support in Siemens Industry online support (https://
support.industry.siemens.com/cs/de/en/)
Here, you can also subscribe to the newsletter that provides you with latest information relating
to your products.
Readme

1.3 Notes on memory cards
Starting the TIA Portal

When you start the TIA Portal, Windows attempts to update the Certificate Revocation List
(CRL) of "windowsupdate.com".
If no Internet access is available and there are multiple DNS servers, a timeout may occur and
delay the start of the TIA Portal.
1.2
Notes on libraries
Contents
Information that could not be included in the online help and important information about
product characteristics.
Comparing library elements

If master copies and types have the same name, the corresponding objects in the project are
overwritten when the action "Copy" is used. Please note that this takes place without a prompt.
The same behavior occurs when the name of the master copy is different to the name of the
type, but an object within the master copy has the same name as the type.
1.3
Notes on memory cards
Contents
Notes on SIMATIC memory cards

The SIMATIC memory cards have been formatted and set up by Siemens for use with S7-1200
and S7-1500 modules. This format must not be overwritten; otherwise, the card will no longer
be accepted by the modules. Formatting with Windows tools is therefore not permitted.
Behavior in case of open force job

Note that an active force job is retained even after you have loaded a new project to the
SIMATIC memory card. This means you should first delete the active force job before you
remove a SIMATIC memory card from the CPU and before you overwrite the card in the PC
with a new project. If you use a SIMATIC memory card with unknown content, you should
format the SIMATIC memory card before the next download.
Readme

1.4 Notes on the hardware configuration
Access protection for memory cards in USB card readers

By improving the security mechanisms for online access and engineering of S7-1500 CPUs,
the data storage on memory cards has been changed. For this reason, this version of STEP
7 cannot evaluate the passwords of the configured protection level when reading project data
from memory cards that is accessed via a USB card reader. The changed response affects
the memory cards for CPUs of the S7-1200/1500 series. Therefore, use physical safeguards
to protect critical project data on memory cards for these devices.
Note
This restriction is not related to online access to devices or the know-how protection of program
blocks.
1.4
Notes on the hardware configuration
Content
Subnet addressing for CP 1613 and CP 1623

CP 1613 and CP 1623 are communication modules with microprocessor. To ensure secure
management of communication links, these are processed on the module. The protocol stack
in your PC is used for diagnostic purposes (SNMP, DCP). To allow both protocol stacks (i.e.
CP 1613/23 Firmware and CP 1613/23 NDIS access) access to the same partners, is
recommended to place both stacks of a module in the same subnet.
Editing a device IP address

Do not use the address range from 192.168.x.241 to 192.168.x.250 when editing a device IP
address. If necessary, this address range is automatically assigned by the system to a
programming device. Depending on the subnet mask, this applies also for all network classes.
Drivers for the CP 5512 communications processor

The drivers for the CP 5512 are no longer included in this software version. If you want to use
the CP 5512, the following needs to be installed prior to the installation of this software:
http://support.automation.siemens.com/WW/view/78453460 (http://
support.automation.siemens.com/WW/view/en/78453460)
Readme

1.6 Notes on using the TIA Portal in a virtual environment (private cloud)
Please note that the CP 5512 can be used with a maximum of Windows 7 32-bit. As of Windows
8 or with 64-bit operating systems, the CP 5512 is not compatible.
Note
Since 2009, the functional successor the USB 2.0 module CP 5711 has been available.
1.5
Notes on instructions
Contents
Instructions not valid for all CPU firmware versions

The firmware version of your CPU determines the following:
Whether a specific instruction is available for this CPU:
If you select CPU 1211C DC/DC/DC with firmware version V1.0, for example, the
extended instruction "T_COMBINE" will not be available to you. It is grayed out in the
"Instructions" task card.
However, if you select CPU 1211C DC/DC/DC with firmware version V3.0, the extended
instruction "T_COMBINE" will be available to you in versions V1.1 and V1.2.
Which versions of the instruction are available. You can select the different versions in the
"Version" column of the "Instructions" task card.
1.6
Notes on using the TIA Portal in a virtual environment (private cloud)
Contents
Instructions for using the TIA Portal in a virtual environment (private cloud)
You can find instructions on how to use the TIA Portal in a virtual environment (private cloud)
on the installation disk in the directory "Documents\Readme\<language directory>". You can
open the PDF document "TIAPortalCloudConnectorHowTo<language ID>.pdf" here.
The TIA Portal Cloud Connector can be used with the Windows 7 (64-bit) and Windows 8.1
(64-bit) operating systems. Using the TIA Portal Cloud Connector with Windows 10 is in
development.
Readme

1.6 Notes on using the TIA Portal in a virtual environment (private cloud)
Environment variables "TiaUserSettingsPath" and "TiaDefaultProjectPath"

The environment variables "TiaUserSettingsPath" and "TiaDefaultProjectPath" can be used
to set the location of the user and project settings different from the system default. This can
be used, for example, to save the user and project settings at a central location.
You can find additional information on the use of environment variables in the Instructions on
Using the TIA Portal in a Virtual Environment (Private Cloud).
Cross-domain HTTPS connections with the TIA Portal Cloud Connector

The TIA Portal Cloud Connector cannot create certificates that are valid for multiple domains.
Comparing the configured and actual topology

Topology comparison is not supported by the TIA Portal Cloud Connector.
Note on using self-signed certificates when using HTTPS as the communication protocol
Microsoft regularly checks whether the certificates in the Windows Certificate Store are from
a trusted source. Certificates from untrusted sources are deleted. Therefore, ensure that your
self-signed certificates are signed with a secure certificate.
10
Readme
STEP 7 Professional
2.1
Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement and continuously maintain a holistic, state-of-the-art industrial
security concept. Siemens products and solutions only form one element of such a concept.
Customer is responsible to prevent unauthorized access to its plants, systems, machines and
networks. Systems, machines and components should only be connected to the enterprise
network or the internet if and to the extent necessary and with appropriate security measures
(e.g. use of firewalls and network segmentation) in place.
Additionally, Siemens guidance on appropriate security measures should be taken into
account. For more information about industrial security, please visit
http://www.siemens.com/industrialsecurity (http://www.industry.siemens.com/topics/global/
en/industrial-security/Pages/Default.aspx)
Siemens products and solutions undergo continuous development to make them more secure.
Siemens strongly recommends to apply product updates as soon as available and to always
use the latest product versions. Use of product versions that are no longer supported, and
failure to apply latest updates may increase customers exposure to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS
Feed under
Network settings
The following tables show the network settings of each product you need to analyze the
network security and to configure external firewalls:
STEP 7 Professional
Name
Port number
Transport
protocol
Direction
Function
Description
ALM
4410*
TCP
Inbound/out
bound
License serv
ice
This service provides the complete function

ality for software licenses and is used by
both the Automation License Manager as
well as all license-related software products.
TCP
Outbound
S7 communi
cation
Communication to the S7 controller via

Ethernet/PROFINET for programming and
diagnostic purposes.
RFC 1006 102
Readme
11
STEP 7 Professional
2.2 Notes on use
STEP 7 Professional
DCP
---
Ethernet
Outbound
PROFINET
The DCP protocol (Discovery and Basic

Configuration Protocol) is used by PROFI
NET and provides the basic functionality for
locating and configuring PROFINET devi
ces.
SNMP
161
UDP
Outbound
PROFINET
The SNMP client functionality is used by

STEP 7 to read status information from
PROFINET devices.
* Default port that can be changed by user configuration
WinCC ES Basic (without simulation)

Name
Port number
Transport pro Direction

tocol
Function
Description
ALM
4410*
TCP
Inbound/out
bound
License serv
ice
This service provides the complete function

ality for software licenses and is used by
both the Automation License Manager as
well as all license-related software products.
HMI Load
1033
TCP
Outbound
HMI Load (RT

Basic)
This service is used to transmit images and

configuration data to Basic Panels.
Simulation RT Basic
Name
Port number
Transport pro Direction

tocol
Function
Description
HMI Load
1033
TCP
Inbound
HMI Load (RT

Basic)

Ethernet/
IP
44818
TCP
Outbound
Ethernet/IP
channel
The Ethernet/IP protocol is used for connec

tions to Allen Bradley PLCs.
2222
UDP
Inbound
Ethernet/IP
channel

Modbus
TCP
502
TCP
Outbound
Modbus TCP
channel
The Modbus TCP protocol is used for con

nections to Schneider PLCs.
RFC 1006
102
TCP
Outbound
S7 channel
Communication to the S7 controller via

Ethernet/PROFINET
Mitsubishi
MC
5002
TCP
Outbound
Mitsubishi MC
channel
The Mitsubishi protocol is used for connec

tions to Mitsubishi PLCs.
2.2
Notes on use
Contents
12
Readme
STEP 7 Professional
2.2 Notes on use
Online operation
Simultaneous online operation of STEP 7 V5.5 or earlier versions and STEP 7 Professional
V14 is not approved.
Simultaneous online connections on an S7-1200 CPU

It is not possible to establish an online connection from multiple instances of the TIA Portal
simultaneously to the same S7-1200 CPU.
Parallel use
If the term "Combo" appears in the name or license key of the software after installation, the
use of the following products/versions is permitted in accordance with Article 1.6 of the General
Terms and Conditions (see also setup text):
STEP 7 Professional 2010
STEP 7 Professional 2006
PLC migration
No instruction profile should be activated during PLC migration.
Deactivate your instruction profile before you perform the PLC migration. You can then
reactivate the profile again.
Removing/inserting the memory card

After removing or inserting a memory card, always perform a memory reset on the CPU in
order to restore the CPU to a functional condition.
Removing and inserting Ethernet modules

If Ethernet modules are removed and re-inserted during operation, you must boot the PC;
otherwise, the "Accessible devices" functionality in STEP 7 or NCM PC will not display all
devices. While the PC boots, Ethernet modules must be activated.
Loading project data with TIA Portal V12 and V13 (S7-1200)
If you load the project data of an S7-1200 CPU with the TIA Portal V13, you can no longer use
TIA Portal V12 to access this data. To do this, first restore the factory settings of the CPU.
Read the additional information on this in the online help under "How to reset a CPU to factory
settings".
Compatibility
The device configuration and program of an S7-1200 CPU must always be configured with the
same STEP 7 version. Usually, the TIA Portal makes sure that no version conflicts occur by
outputting appropriate notifications during loading to the device.
Readme
13
STEP 7 Professional
2.3 Editing devices and networks
This automatic verification is not possible with S7-1200 CPUs with firmware version V1.x. In
this case, users themselves must ensure that no version conflicts occur.
2.3
Editing devices and networks
2.3.1
General information on devices and networks
Content
Port Configuration Tool PCT

If you use the PCT tool, make sure that you always use the current version that is available
free of charge with the following link:
http://support.automation.siemens.com/WW/view/32469496 (http://
support.automation.siemens.com/WW/view/en/32469496)
The PCT tool is available for installation on the DVD in the "Support" folder.
2.3.2
Use of modules on the S7-1200
Content
Use of modules on the S7-1200

The modules listed below are not supported on the S7-1200.
14
Family
Module
Order number
S7-300 FMs
SM 338
6ES7 338-4BC01-0AB0
FM 350-1
6ES7 350-1AH03-0AE0
FM 350-2
6ES7 350-2AH00-0AE0, 6ES7 350-2AH01-0AE0
FM 351
6ES7 351-1AH01-0AE0, 6ES7 351-1AH02-0AE0
FM 352
6ES7 352-1AH02-0AE0
FM 355 S
6ES7 355-1VH10-0AE0
FM 355 C
6ES7 355-0VH10-0AE0
FM 355-2 C
6ES7 355-2CH00-0AE0
FM 355-2 S
6ES7 355-2SH00-0AE0
Readme
STEP 7 Professional
Family
Module
Order number
S7-300 PtP-CP
CP 340
6ES7 340-1AH02-0AE0, 6ES7 340-1BH02-0AE0, 6ES7

340-1CH02-0AE0
CP 341
6ES7 341-1AH01-0AE0, 6ES7 341-1AH02-0AE0, 6ES7

341-1BH01-0AE0, 6ES7 341-1BH02-0AE0, 6ES7
341-1CH01-0AE0, 6ES7 341-1CH02-0AE0
Network component
Diagnostics repeater 6ES7 972-0AB01-0XA0
ET 200S
1 Count 24 V
6ES7 138-4DA04-0AB0
1 Count 5 V
6ES7 138-4DE02-0AB0
1 Step 5 V
6ES7 138-4DC00-0AB0, 6ES7 138-4DC01-0AB0
2 pulses
6ES7 138-4DD00-0AB0, 6ES7 138-4DD01-0AB0
1 SI
6ES7 138-4DF01-0AB0
1 SI Modbus
6ES7 138-4DF11-0AB0
1 SSI
6ES7 138-4DB02-0AB0, 6ES7 138-4DB03-0AB0
1 Pos Universal
6ES7 138-4DL00-0AB0
SIWAREX
7MH4910-0AA01, 7MH4912-0AA01, 7MH4920-0AA01
SIWAREX
7MH4 900-2AA01, 7MH4 900-3AA01, 7MH4 950-1AA01,

7MH4 950-2AA01
ET 200M
Loading S7-1200 module comments to the PG/PC

In central configurations with S7-1200, comments of modules, submodules and signal boards
are not loaded. With CPs/CMs, only the comments of the IE interface or DP interface are
loaded. In distributed configurations with ET 200SP or ET 200MP, only the comment of the
channels is loaded from the I/O modules.
2.3.3
CP 343-2 on SIMATIC S7 Embedded Controller EC31-RTX
Contents
CP 343-2 on SIMATIC S7 Embedded Controller EC31-RTX

The module AS-Interface CP 343-2 (article no.: 6GK7 343-2AH01) can be inserted in an
expansion rack of the SIMATIC S7 Embedded Controller EC31-RTX (article no.: 6ES7
677-1DDxx-0BB0), but the CP 343-2 cannot be operated with the EC31-RTX.
Readme
15
STEP 7 Professional
2.3.4
F-CM AS-i Safety ST for ET 200SP
Content
F-CM AS-i Safety ST (3RK7 136-6SC00-0BC1) from HSP0070

When using an F-CM AS-i Safety ST (3RK7 136-6SC00-0BC1) using HSP0070 in TIA Portal
V13.0, after updating to Service Pack 1, the HSP0070 (F-CM AS-i Safety ST) must be updated
to version V2.0. This is necessary to allow use of the module in TIA Portal V13 Service Pack
1.
2.3.5
S7 routing via IE/PB Link
Content
S7 routing via IE/PB Link

In the following situations, no routing via the IE/PB Link PN IO is possible:
S7 routing between two CPUs of the S7-1500
S7 routing of PG connections to CPUs of the S7-1200/1500
S7 routing of HMI connections to CPUs of the S7-1200/1500
This behavior relates to the IE/PB Link with firmware version V2.1 (6GK1 411-5AB00).
2.3.6
Notes on the S7-1500 Web server
Contents
product features.
Web server access to data log files for S7-1500 CPUs

Contrary to the information in the online help, it is not possible delete, rename and upload files
located in the folder "Datalogs" of the SIMATIC memory card with File Browser access via the
Web server of the S7-1500 CPUs.
16
Readme
STEP 7 Professional
See also sections 3.12 and 3.13 of the following manual: S7-1500 Web server (https://
support.industry.siemens.com/cs/ww/en/view/59193560)
2.3.7
Notes on Secure Open User Communication
Secure Open User Communication between two S7-1500 CPUs via CP interface
In the description of the online help for establishing secure TCP connections on the TLS
client, the information about variables of the system data type TCON_IP_V4_SEC are
reversed.
The following information is correct:
TLSServerCertRef: Enter the value 2 (reference to the CA certificate of the TIA Portal project
(SHA256) and the value 1 (reference to the CA certificate of the TIA Portal project (SHA1)).
TLSClientCertRef: ID of the own X.509-V3 certificate.
In general, the following applies for all Secure OUC Communication variants:
On the TLS client, always enter the ID of the own X.509-V3 client certificate for the
TLSClientCertRef tag! The TLSServerCertRef tag has the value of the ID from the CA
certificate of the TLS server for authenticating the TLS server.
On the TLS server, always enter the ID of the own X.509-V3 server certificate for the
TLSServerCertRef tag! The TLSClientCertRef tag, in this case, has the value of the ID from
the CA certificate of the TLS client for authenticating the TLS client.
2.3.8
Deactivating SNMP (S7-1200, S7-1500)
Contents
Deactivating SNMP (S7-1200, S7-1500)

In the description for deactivating SNMP, the wrong record number is cited ("Index" parameter
of the WRREC instruction).
The correct data record number is 16#b071.
Example program with WRREC call in OB 100 and correct data record number
DATA_BLOCK "Deactivate_SNMP"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
NON_RETAIN
VAR
Readme
17
STEP 7 Professional
snmp_deactivate : Bool;
snmp_record : Struct
BlockID : UInt;
BlockLength : UInt;
"Version" : USInt;
Subversion : USInt;
Reserved : UInt;
SNMPControl : UDInt;
END_STRUCT;
snmp_done : Bool;
snmp_error : Bool;
snmp_Status : DWord;
END_VAR
BEGIN
snmp_deactivate := true;
snmp_record.BlockID := 16#f003;
snmp_record.BlockLength := 8;
snmp_record."Version" := 1;
END_DATA_BLOCK
ORGANIZATION_BLOCK "Startup"
TITLE = "Complete Restart"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
BEGIN
REPEAT
"WRREC_DB_1"(REQ := "Deactivate_SNMP".snmp_deactivate,
ID := "Local~PROFINET interface_1",
INDEX := 16#b071,
DONE => "Deactivate_SNMP".snmp_done,
ERROR => "Deactivate_SNMP".snmp_error,
STATUS => "Deactivate_SNMP".snmp_Status,
RECORD := "Deactivate_SNMP".snmp_record);
UNTIL "Deactivate_SNMP".snmp_done OR "Deactivate_SNMP".snmp_error
END_REPEAT;
END_ORGANIZATION_BLOCK
DATA_BLOCK "WRREC_DB_1"
{OriginalPartName := 'WRREC';
VersionGUID := 'bc169451-58cd-44a3-855b-3f78cc0623c8';
S7_Optimized_Access := 'TRUE' }
AUTHOR: SIMATIC
FAMILY: DP
NAME: WRREC
VERSION : 1.0
NON_RETAIN
WRREC
BEGIN
END_DATA_BLOCK
18
Readme
STEP 7 Professional
2.3.9
Amendment to description of "Configuring multiple rings"
Requirements
The device Scalance X300 as of V4.0 listed in the requirements which supports multiple rings
as a manager, is not included in the hardware catalog of STEP 7. You need the to download
and install PROFINET GSD file for Scalance X300 from the online support website in order to
configure the device.
Adapting preset MRP roles

If you interconnect the devices of the example configuration as described in the help, the MRP
roles are initially set to "Not device in the ring" for all devices.
This configuration is not consistent.
You have the following options:
You can manually assign MRP roles according to the rules of MRP configurations described
in the help. To do this, edit the properties of the PROFINET IO system, in the area "MRP
Domains > Ring interconnection".
You can have the MRP roles assigned automatically by STEP 7.
In both cases, select a configured MRP ring and click the "Configure MRP automatically"
button. Repeat the process for each configured MRP ring.
The rings are then are assigned new MRP domains and the MRP roles and MRP instances
are set. The configuration is inconsistent.
Tip: Delete the unneeded MRP domains

If you want to delete unneeded MRP domains, for example, because they no longer contain
any devices, select the PROFINET IO system and then select the "MRP Domains" area.
Navigate to the first table. This is the table in which you select the default domain.
Select the row with the MRP domain to delete and press the <Del> key.
You can delete any MRP domain except the default domain.
2.3.10
Notes on online and diagnostics
Contents
Readme
19
STEP 7 Professional
Hardware detection followed by online connection

When the "Online > Hardware detection" command is performed for an unspecified CPU, the
online configuration is not loaded from the CPU. If you do not load the configuration resulting
from the hardware detection to the CPU, the device and network views will always show a
difference between the offline and online configurations. It will appear that there are different
configurations in the online and diagnostic views, although the MLFBs are identical in the actual
CPU and the offline CPU.
Transferring numerous and large trace measurements from the device (memory card)
Transferring trace measurements from the device to the project increases the memory
requirement.
Avoid copying a large number of measurements with large amounts of data at the same time
lead to high memory consumption and extended periods needed for copying.
2.3.11
Network components
2.3.11.1
Network components
S7-CM/CP
No S7 routing with CP 300/400 < V3 as router
With S7 routing between S71200 or S71500 stations, no connection is established when
older S7300/400 CPs are connected in between as routers. The following types of
communication that run over ISO transport or ISO-on-TCP connections are affected:
S7 communication
PG communication
HMI communication
The behavior applies to S7300/400 CPs with a firmware version < V3.0 for which the TSAP
length is limited to 2 bytes.
In contrast, like the S71200/1500, S7300/400 CPs as of V3.0 support long TSAPs and thus
also S7 routing.
CM 15421: Remove retentive storage of the IP address if there are duplicate addresses
The IP address and the device name of the CM 1542-1 remain installed retentively:
If, for example during startup, the CM detects a duplicate address in another network, the CM
is not connected to the network. The CM changes to RUN and cannot be reached via the
Ethernet interface.
20
Readme
STEP 7 Professional
To be able to connect the CM to the network, you can remove the retentively stored IP address
as follows:
1. Remove the memory card of the CPU.
2. Using DCP with the Primary Setup Tool (PST) and with the CPU in STOP, set the IP address
of the CM to 0.0.0.0 without configuration.
You have removed the retentively stored IP address of the CM. The CM can be connected
into the network.
3. Insert the memory card in the CPU again.
Special diagnostics and firmware loader in Chinese interface language

When you open the special diagnostics or the firmware loader with a Chinese GUI, you need
to set the language for non-Unicode applications in the operating system to Chinese.
PC CPs and applications

PC CPs for VMware vSphere Hypervisor ESXi
The following communications processors have been released for operation with VMware
vSphere Hypervisor ESXi for STEP 7 Professional V14:
CP 5711
VMware E1000 network adapter
The following communications processors have not been released for operation with VMware
vSphere Hypervisor ESXi:
CP 5611
CP 5612
CP 5621
CP 5622
CP 5512
Other communications processors such as the CP 1623 and CP 1628 are released following
installation of the SIMATIC NET PC software. You will find information on this in the readme
file of the SIMATIC NET PC software.
Download to PC stations
If you download project data to a PC station with PC-CP, make sure that the CP is available.
In the "Extended download to device" dialog, do not enable the check box for the search for
compatible nodes.
If you want to download to a different CP from the one selected earlier in the project, change
the IP address of the CP manually in the "Extended download to device" dialog in the list of
configured access nodes.
Readme
21
STEP 7 Professional
PROFIBUS S7 connections with OPC servers

The configuration of an S7 connection via PROFIBUS is not possible between an OPC server
as of V12 and an S71200 as of V4 or an S71500.
Remedy: Use an OPC server / PC application < V12 or use an S71200 < V4 or an S7300 or
S7400 as the S7 station.
Security modules
Migration of projects with Ethernet CPs and activated security functions
In STEP 7 V5.5 projects that contain Industrial Ethernet CPs with activated security functions,
the security settings are disabled during migration to STEP 7 Professional.
If necessary, follow these steps after the migration:
1. Activate the security functionality.
2. Configure the required security settings.
Migration of IP access protection lists when activating the security functions

An active IP access protection list is converted to firewall rules when security functions are
activated. These rules are visible in advanced firewall mode and can be adjusted there. The
advanced firewall mode is activated automatically.
Security online diagnostics of S7 CPs

Security online diagnostics of a CP with security capability is only possible if the online
connection is established directly via the CP. If the online connection was established by
STEP 7 via the CPU to the station, with the "Connect online" button on the security diagnostics
page "Security" > "Status" of the security CP you can establish a direct connection to the CP
to run security online diagnostics. As an alternative, you can also terminate the online
connection to the CPU and enter the IP address of the CP in the "Station address" input box
under the entry "Online access" in online diagnostics.
IKE mode
When negotiating the key in phase 1 the IKE mode "Main" should be preferred. This mode
normally provides a reliable procedure compared with the "Aggressive" mode. One reason for
using the "Aggressive" setting is when you have VPN groups with different pre-shared keys.
The IKE "Aggressive" mode should not be used in conjunction with certificates. In the IKE
"Aggressive" mode, only use pre-shared keys.
A security module must not be used in VPN groups that use different IKE modes.
Downloading configuration data to an S7-300/400 via a VPN tunnel

When you download configuration data via the gigabit interface of a CP x43-1 Advanced to an
S7-300/S7-400 station, the path via which the download takes place is stored in the project.
22
Readme
STEP 7 Professional
If the project is then downloaded via a VPN tunnel established between a SCALANCE S
module and the CP x43-1 Advanced, the download fails due to the changed path.
To download via the VPN tunnel, follow the steps below:
1. Using the "Go online" button, connect the engineering station to the gigabit interface of the
CP x431 Advanced.
2. Disconnect the online connection to the CP x431 Advanced.
3. Download the project to the station via the gigabit interface of the CP x431 Advanced.
VPN tunnel establishment with 1200/1500 CPs capable of VPN

The establishment of VPN tunnel connections by 1200/1500 CPs capable of VPN with the
authentication method "pre-shared key" is only possible if the VPN connection partner is also
a 1200/1500 CP capable of VPN. The establishment of VPN tunnel connections by a
1200/1500 CP capable of VPN to all other VPN connection partners is only possible with the
"certificate" authentication method.
Security configurations from old projects

Before a security configuration from an older STEP 7 version in STEP 7 V14 can be used, a
user with administrator rights needs to log in to this security configuration in STEP 7 V13 SP1
and save the project. After opening the project in STEP 7 V14, a user must log on again to the
security configuration with administrator rights. Thereafter, it is possible to use this security
configuration in STEP 7 V14.
Copying security modules between STEP 7 instances

Copying security modules between different instances of STEP 7 is not supported.
Device certificates for CP 1543-1 V2.0 and CP 1543SP-1

For CP 1543-1 V2.0 and CP 1543SP-1, only those device certificates that are assigned to the
module via the local certificate manager as device certificates are loaded to the module. This
assignment takes place in the local security settings of the module in the "Certificate manager"
entry via the "Device certificates" table editor. The certificates of the global certificate manager
are available for the certificate assignment.
Media converters
When you migrate a project, you need to reconfigure the media converters.
Readme
23
STEP 7 Professional
2.4 Programming a PLC
2.4
Programming a PLC
2.4.1
General notes on PLC programming
Content
Copying ProDiag FBs

A ProDiag function block has to be compiled after copying in order to ensure the consistency
of the ProDiag configuration. Any difference is always displayed in an offline comparison after
copying.
Upgrading know-how-protected blocks

Know-how protected blocks that were set up with a version <V14 can be loaded without
entering the password in the controller and can be run after upgrading from V13 SP1 to V14.
To edit a know-how protected block in V14, remove the know-how protection and reset it when
done. The block can then be renumbered and renamed in the know-how-protected state
(S7-1200 / S7-1500).
For know-how protected blocks that were set up with V13 SP1:
To edit a know-how protected block in V14, remove the know-how protection and reset
it when done. The block can then be renumbered and renamed in know-how-protected
state.
For know-how protected blocks that were set up PRIOR TO V13 SP1:
To edit, remove the know-how protection in V13 SP1 and reset it when done.
Information about network security

For communications access between the TIA Portal and CPU or between HMI (except for HMI
access using "GET/PUT communication") and CPU, there are integrated security functions.
These provide greater protection from manipulation and higher access protection. To protect
against unauthorized network access to a CPU with standardized communications access
such as "GET/PUT", "TSEND/TRCV", "Modbus", "FETCH/WRITE", you should also take
suitable additional measures (e.g. cell protection concept).
Functions from the global library "Long Functions" with PLCSIM S7-1500
The compilation process links the functions of the S7-1500 CPU family to the CPU to protect
them from manipulation. Function from the global library "Long Functions" that are used in the
CPU and have such a link cannot be loaded to a simulation. However, it is possible to replace
such elements with their originals from the global library. These are not linked to a CPU.
24
Readme
STEP 7 Professional
Loading inconsistent programs to an S7-1500 CPU

In TIA Portal, it is not possible to download inconsistent programs to an S7-1500 CPU without
a consistency check. During the loading process, all blocks of the program are implicitly
checked and are compiled again in the event of inconsistencies. If, however, there are
programs on your CPU which were loaded with earlier versions of STEP 7, these programs
could demonstrate inconsistencies.
In this case, note the following:
If you load an inconsistent program from a device, you will not be able to load the program
back to an S7-1500 CPU unchanged afterwards, because a consistency check always takes
place during the loading process and existing inconsistencies are corrected.
Changed access rights for displaying the comparison status

Valid for:
CPU 1500 < V2.0 (as well as ET200 SP and Software Controller)
CPU 1200 V4.0 and V4.1
As of TIA Portal V14, the required access rights for displaying the comparison status of blocks
have changed for the specified CPUs from the S7-1200/1500 series.
Previously, you only needed the "HMI access" access level for the listed CPUs to display the
comparison status. As of V14, you need the "read access" access level to display the
comparison status.
This change means that you are prompted to enter the password for "read access" when you
go online.
If you only have the password for "HMI access", you can still establish an online connection.
In this case, click "Cancel" in the password prompt for read access and enter the password
for "HMI access" in the subsequent dialog. The online connection is then established with the
available "HMI access rights", but no comparison status of the blocks is displayed.
Only questions marks are displayed in place of the icons for the comparison status.
Valid for:
CPU 1200 <=V3.x.
As of TIA Portal V14, there is now a password prompt for the above specified CPUs when you
go online for displaying the comparison status of blocks, provided that these CPUs are
configured with write protection and/or read protection.
If you do not know the password for access to read-protected blocks on a protected CPU, you
can still establish an online connection.
In this case, leave the displayed password prompt dialog with "Cancel".
The online connection is still established, but no comparison status of the blocks is displayed.
Only questions marks are displayed in place of the icons for the comparison status.
Data exchange between standard and F-program when using Team Engineering
To ensure data consistency between standard and safety program, you should:
Readme
25
STEP 7 Professional
Not exchange data via bit memory, but rather using global data blocks.
Limit access between safety programs and standard user programs to two standard data
blocks.
You can find information on this in the section 5.13 of the Programming Guidelines under:
https://support.industry.siemens.com (https://support.industry.siemens.com/cs/document/
81318674/programming-guideline-and-programming-styleguide-for-s7-1200-and-s7-1500?
dti=0&lc=en-WW)
Online/offline differences in the project tree (S7-1200 FW V2.0 and V2.1)

If you use the "WRIT_DBL" instruction to change a data block, the resulting difference between
online and offline block is initially not displayed correctly by the symbols in the project tree.
The difference is only shown when you terminate an online connection and then go back online.
Avoid using PLC data types generated by the system in libraries

Some instructions generate their own PLC data types during instancing which are saved in
the "PLC data types" project folder. However, you should not use these system-generated
PLC data types in any library, because they may be recreated by the system at any time and
may result in an unfavorable system behavior.
See also
https://support.industry.siemens.com (https://support.industry.siemens.com/cs/document/
81318674/programming-guideline-and-programming-styleguide-for-s7-1200-and-s7-1500?
dti=0&lc=en-WW)
2.4.2
Instructions
Contents
"TUSEND instruction: Send data" instruction

For S7-1500 CPUs as of firmware version V2.0, the following applies to the "TUSEND"
instruction: When addressing the remote partner via the "TADDR_Param" system data type,
a limited broadcast (255.255.255.255 as the IP address of the remote partner) is supported
with consistent compliance to IP routing rules. Accordingly, limited broadcasts are only sent
over an interface through which a default router is accessible according to configuration.
It is recommended to use of directed broadcast addresses because they - according to the IP
standards - are not subject to this restriction.
26
Readme
STEP 7 Professional
Instructions "READ_BIG", "READ_LITTLE", "WRITE_BIG" and "WRITE_LITTLE"

When using actual parameters with an ARRAY index variable for the SRC_ARRAY and
DEST_VARIABLE, the correct index is now calculated.
Instruction "Get_Alarm: Read pending message"

In addition to the values described in the online help, the RET_VAL parameter can also adopt
the following values:
Error code
(W#16#...)
Explanation
8004
You have already logged on via the OperateMode = 1 parameter in the user program
to read the pending messages. You are only allowed and required to log on again if you
log out using the OperateMode = 3, have reconfigured alarm or performed a STOP >
RUN transition.
Instruction "Get_AlarmState: Output alarm status"

Contrary to the information in the online help, the following applies to the description of the
parameter Alarm:
Instance of the instruction "Generate program alarm with associated values":
Alarm.Messagetype = Alarm_AP, the bit Ac has either the signal status 0 or 1 and the bit
Ag has the signal status 1
not active: 0x86 (1000 0110)
active/not acknowledged: 0x85 (1000 0101)
active/acknowledged: 0x87 (1000 0111)
outgoing/not acknowledged: 0x84 (1000 0100)
Alarm.Messagetype = Notify_AP, the bits Ac and Ag both have the signal status 1
not active: 0x86 (1000 0110)
active: 0x87 (1000 0111)
Alarm.Messagetype = Inforeport_AP, the bits Ac and Ag both have the signal status 1
not active: 0x86 (1000 0110)
(temporary) active: 0x87 (1000 0111)
If the alarm is not active, bit S always has the signal status 0.
Instruction "Get_IM_Data: Reading identification and maintenance data"

In addition to the values described in the online help, the STATUS parameter can also have
the following value:
80A1: LADDR addresses a device that does not support the output of I&M 1, I&M 2 or I&M 3
data.
Readme
27
STEP 7 Professional
Optimizing the run time of instructions such as "Serialize", "Deserialize", "CMP", which can process
structures
A series of instructions (e.g. "Serialize: Serialization", "Deserialize: Deserialization", "CMP"
(comparator) and "MOVE: Copy value") can process very large, complex structured tags. In
doing so, the CPU analyzes the form of the tag structure and executes the corresponding
instruction for each substructure contained in the total structure or for all contained elementary
components.
With a very complex structure, this structure analysis may lead to an unexpected increase in
the run time of the corresponding instruction. In addition to the complexity of structured tags
specified in the operation, the total number of anonymous structures declared in the program
also has an effect on the run time. A very large number of different anonymous structure
definitions can also increase the run time.
Solution:
Avoid anonymous structures These are structures that are defined directly on the tag with
the keyword "Struct" and not through a user-defined data type (UDT).
Avoid multiple declaration of data structures that are structured very similarly. Try to
assemble these into a structure declaration.
Avoid the declaration of numerous individual tags in structures and data blocks, if they have
the same data type and represent an array of the function. In this case, you should use the
ARRAY data type if possible.
Instruction "CTRL_PWM: Pulse width modulation"

In addition to the option described in the online help of changing the pulse duration from the
user program, you can also change the cycle time from the user program.
To do this, select the check box "Permit change to cycle time in runtime" in the "Pulse options"
of the corresponding pulse generator. When this check box is selected, the first two output
bytes contain the pulse duration and the third to sixth output byte contains the cycle time.
During the run time of the pulse generator, you can change the value of the double word at
the end of allocated memory of the outputs. This changes the cycle time of the PWM signal.
Example: Select the check box so that the CPU assigns PWM1 six output bytes, and select
AB1008 to AB1013 for this. After loading the program into the CPU and starting the pulse
generator, you can change the pulse duration by writing AW1008 and the cycle time by writing
AD1010.
Cycle time
Pulse duration
28
Readme
STEP 7 Professional
Instruction "Get_IM_Data: Reading identification and maintenance data"

Currently, the "Get_IM_Data" instruction outputs the error code 16#0000 when a string that is
too short is used at the DATA parameter.
The 16#8752 error code would be correct. You can find the corresponding description of the
16#8752 error code in the description of the instruction in the information system.
Output parameters of the S7-1500 instructions

If an access error or a programming error occurs while the instruction is being executed, the
value of the output is undefined.
2.4.3
Testing the user program
2.4.3.1
Testing with the watch table
Contents
Multiple access to the same CPU (S7-300/400/1200)

Online access to a CPU (S7-300/400/1200) from a PG/PC is permitted only when a TIA Portal
is open. Multiple access to the same CPU of this family is not permitted and can lead to errors.
Loading data blocks during an active control job

Note
Loading changed data blocks during an active control job can result in unforeseen operating
states. The control job continues to control the specified address, although the address
assignment may have changed in the data block. Complete active control jobs before loading
data blocks.
"Enable peripheral outputs" function

The function "Enable peripheral outputs" in not available for CPUs of the S7-1500 series in
the TIA Portal V14.
This function can only be executed with an S7-300, S7-400 or S7-1200 CPU in TIA Portal V14.
Readme
29
STEP 7 Professional
Testing programs converted from older STEP 7 versions

To monitor and test a program converted from an older STEP 7 version, you first need to
compile and download the program with the current STEP 7 version.
Changed display formats in the watch table

The number of display formats has been reduced so that display formats that are used but no
longer supported are reset to the defaults during a project upgrade.
Example: Pointers can now only be shown in "Pointer" or "Hexadecimal" format.
2.4.3.2
Testing with the force table
Contents
Forcing tags for direct I/O access

If you use direct I/O access for an S7-300 CPU in your user program, forcing this I/O address
is not permitted.
Example
If I/O access to the address "IB0:P" takes place in the user program, it is not permitted to force
the following I/O address areas: I0.0:P, IB0:P, IW0:P and ID0:P.
Changed display formats in the force table

The number of display formats has been reduced so that display formats that are used but no
longer supported are reset to the defaults during a project upgrade.
Example: Pointers can now only be shown in "Pointer" or "Hexadecimal" format.
2.4.4
Compatibility of PLC programs from older versions
2.4.4.1
Compatibility of PLC programs from versions prior to V14
Content
30
Readme
STEP 7 Professional
Compatibility
In principle, you can continue to use in V14 all PLC programs that were created with older
versions of the TIA Portal. However, because improvements were made to the compiler and
errors corrected there in V14, it can occur in rare cases that the program reacts differently after
the upgrade or that you have to adjust the program code manually. These cases are described
in detail below.
Instructions "SRW", "SLW" and "SSI" (AWL)

The permitted value range of the offset number of these instructions has changed in TIA Portal
V14 from TIA Portal V13 SP1.
In version V13 SP1, it is possible to specify a number in the range 0 to 31 as an offset number
on a CPU of the S7-1200/1500 series and a number in the range 0 to 15 as an offset number
on a CPU of the S7-300/400 series.
In version V14, the value ranges for all CPU series (S7-300/400/1200/1500) was set to the
uniform value from 0 to 15.
Representation of the BCD format

The representation of the BCD format has changed in regard to the sign from TIA Portal V13
SP1 to TIA Portal V14.
The values in BCD format are show without signs in version V13 SP1.
As of version V14, the values in BCD format are show with sign. This can lead to an altered
representation of the values in BCD format.
Integers (decimal system) Hexadecimal
numbers
Representation in V13
SP1
Representation in V14
16#0000
BCD#0
BCD#0
-26215
16#9999
BCD#9999
BCD#-999
1365
16#0555
BCD#555
BCD#555
21845
16#5555
BCD#5555
BCD#555
4096
16#1000
BCD#1000
BCD#0
-28672
16#9000
BCD#9000
BCD#0
Instructions "SET_BF: Set bit field" and "RESET_BF: Reset bit field"
The response of the instruction in regard to the structures has changed from TIA Portal V13
SP1 to TIA Portal V14.
In version V13 SP1, the number of bits that set or reset are always indicated at the input. This
also applies, for example, if you have specified a structure of data type of the STRUCT or
ARRAY PLC data type. If you want, for example, you want set or reset 10 bits and the structure
contains only 5 bits, then the following 5 bits within the address sequence is also set or reset.
With structures of the type PLC data type, as of version V14 STRUCT or ARRAY the number
of bits contained in the structure represents the maximum number of bits that can be reset: If
you specify the value "20", for example, and the structure only contains 10 bits, only these 10
Readme
31
STEP 7 Professional
bits are set. If you specify the value "5", for example, and the structure contains 10 bits, then
exactly 5 bits are set.
Instructions "SCALE: Scale" and "UNSCALE: Unscale" (S7-1500)

The response of the instruction has changed from TIA Portal V13 SP1 to TIA Portal V14 in
regard to specifying the limits (LO_LIM> HI_LIM).
In version V13 SP1, you received an error message when the low limit was greater than the
high limit.
As of version V14, this value is allowed and the result is inversely proportional to the input
value.
On CPUs of the S7-300/400 series, the instruction has always scaled the result inversely
proportional to the input value.
Unused bits of PLC data types (UDT) with firmware >= V1.8.1
The unused bits of PLC data types in standard memory areas are occupied or overwritten, for
example, for a PLC data type that contains 4 bits.
With firmware versions < V1.8.1, you could not use the unused bits of a PLC data type
elsewhere.
With firmware version >= V1.8.1, all bits are occupied or overwritten even if only 4 bits are
used.
Note
Address assignments
Ensure you do not assign the same absolute address twice to different symbolic address
assignments.
Explicit data type conversion in SCL (S7-1200) with firmware >= V4.2
With firmware versions < V4.2, the string was transferred aligned to the right and filled with
leading spaces during explicit data type conversion of SINT/INT/DINT/REAL_TO_STRING/
WSTRING in SCL.
Example: REAL_TO_WSTRING(12) = ' 1.200000E+1'
As of TIA Portal V13, the string is displayed with a leading sign during explicit data type
conversion of SINT/INT/DINT/REAL_TO_STRING/WSTRING in SCL and transferred aligned
to the left.
Example: REAL_TO_WSTRING(12) = '+1.200000E+1'
32
Readme
STEP 7 Professional
SCL: EN/ENO mechanism with block parameters of data type (W)STRING (S7-1200/1500)
As of TIA Portal V14, it is checked whether block parameters of data type (W)STRING are
truncated when parameters are transferred during runtime. This can occur if formal and actual
parameters have different declared lengths. If the declared length of the target parameter
during runtime is insufficient to accept the (W)STRING, the (W)STRING is truncated and the
enable output ENO is set to "FALSE".
If you evaluate the enable output ENO in your program, the semantics of your program may
change.
Forwarding STRING parameters between optimized blocks and standard blocks (S7-1200/1500)
Prior to TIA Portal V14, no length information about STRINGs was transferred when
parameters were transferred between optimized and non-optimized blocks. This meant that
access errors not detected by the ENO mechanism could occur during the further processing
of the STRING. The enable output ENO remained at TRUE despite an access error.
As of TIA Portal V14, the STRING length information is transferred and access errors are
monitored by the ENO mechanism. If you evaluate the enable output ENO in your program,
the semantics of your program may change.
Length declaration for constants of the "STRING" or "WSTRING" data type

Length declarations are no longer permitted for local and global (W)STRING constants. If your
program includes length declarations, for example, "MyStringConst [7]", these are
automatically removed during the upgrade. This change has no semantic effect on your
program, however.
Changing the base data type for HW_ANY from WORD to UINT
The hardware data type "HW_ANY" is used to identify any hardware component, such as a
module. In V14, the base data type of "HW_ANY" was changed from WORD to UINT. After
the conversion to V14, compiling errors can therefore occur if you have assigned an explicit
WORD constant (such as W#16#1) or a tag of data type WORD at a parameter of data type
"HW_ANY".
In this case, change the notation of the constant (e.g. to 16#1) or change the data type of the
tag to UINT.
Length of block comments

As of TIA Portal V14, the block comments must not exceed a length of 32767 Unicode
characters.
Readme
33
STEP 7 Professional
Syntax check of the instructions "SR: Set/reset flip-flop" and "RS: Reset/set flip-flop"
Inputs, outputs, bit memories as well as static or local data can be used as operands at the
"S" input. Use of constants is not permitted. So far, the use of the constants "0" and "1" was
not rejected by the syntax check. The syntax check was improved in TIA Portal V14 so that
the use of "0" or "1" is now rejected at the "S" input. You may now receive an error message
during the compiling of a program that has been compiled without errors up to this point.
Change your program in this case and use a permitted operand.
Any pointer: Access to optimized data

For a CPU of the S7-1500 series, the ANY pointer can also only point to memory areas with
"Standard" access mode. Access to optimized data is not permitted with an ANY pointer.
A more detailed syntax check of ANY pointers is performed as of TIA Portal V14. Access to
optimized data is now rejected. You may now receive an error message during the compiling
of a program that has been compiled without errors up to this point.
"(L)REAL" data type

With 64-bit Windows versions, the LREAL data type is sometimes evaluated differently than
with the previous 32-bit versions of Windows. A difference may occur when rounding and (L)
real values of constants in the least significant bit.
The potential difference is in the last digit of the mantissa and in most cases therefore only
has a slight effect on the accuracy.
If you evaluate the last digit of the mantissa, the semantics of your STEP 7 program may
change after the conversion.
"ST" parameter for IEC timers

The "ST" parameter of an IEC timer is used internally and it is prohibited to write it. This why
this parameter is no longer visible as of TIA Portal V14. If you have write access in your program
to the "ST" parameter, an error message is generated during compiling after the upgrade.
If you exchange data with Inter Project Engineering and you have access to the "ST" parameter
with HMI, you must first export the project and then re-import it into the proxy CPU. Only then
does the "ST" parameter disappear in the HMI configuration.
Associated values for messages (S7-1500)

Projects created with an older version of the TIA Portal can contain embedded associated
values with different structures in the different project languages. The associated values may
have a different order or may be missing in a different language. When a project of this type
is upgraded, the order of the associated values is harmonized. It is based on the reference
language set in the original project. In this case, it is recommended to have the translated texts
checked and corrected.
34
Readme
STEP 7 Professional
Implicit data type conversion for block parameters of the "DB_ANY" data type
When accessing a block parameter of the "DB_ANY" data type with the syntax DB_ANY.
%DB(B|W|D), no implicit data type conversion was performed previously. The bit pattern of
the source value was simply converted into the target data type. If the target data type was
smaller than the source data type, an overflow occurred and the written value may have been
wrong or inaccurate. The enable output ENO is not set to "FALSE" when accuracy is lost or
runtime errors occur.
As of V14, conversion is performed according to the rules of implicit data type conversion when
parameters are passed with the syntax DB_ANY.%DB(B|W|D). Note that after the upgrade a
different value may be written and the semantics of your program may change. In addition, the
enable output ENO is set to "FALSE" when a runtime error occurs.
Interface of organization blocks with standard access

The interface of organization blocks with standard access must have a minimum size of 20
bytes. In older versions of the TIA Portal, only the interface of OB1 was checked with regard
to the minimum size during the compilation run. As of V14, interfaces of all organization blocks
are checked. You may now receive an error message during the compiling of a program that
has been compiled without errors up to this point.
Comparing variables of WORD data type to variables of the S5TIME data type
As of TIA Portal V14, both variables are converted to the TIME data type when comparing a
variable of WORD data type to a variable of S5TIME data type. The WORD tag is interpreted
as an S5TIME value. If one of the variables cannot be converted, the comparison is not
performed and the result is FALSE. After successful conversion, the comparison is performed
based on the selected comparison expression.
2.4.4.2
Compatibility of PLC programs from versions prior to V13.1
Content
Compatibility
You can continue to use in V13 SP1 all programs that were created with TIA Portal V12 SP1
or V13. However, because improvements were made to the compiler and errors corrected
there (compilation of the program code) in V13 SP1, it can occur in rare cases that the program
reacts differently after the upgrade or that you have to adjust the program code manually.
These cases are described in detail below.
Unused bits of PLC data types (UDT) with firmware >= V1.8.1
The unused bits of PLC data types in standard memory areas are occupied or overwritten, for
example, for a PLC data type that contains 4 bits.
Readme
35
STEP 7 Professional
With firmware versions < V1.8.1, you could not use the unused bits of a PLC data type
elsewhere.
With firmware version >= V1.8.1, all bits are occupied or overwritten even if only 4 bits are
used.
Note
Address assignments
Ensure you do not assign the same absolute address twice to different symbolic address
assignments.
Explicit data type conversion in SCL (S7-1200) with firmware >= V4.2
With firmware versions < V4.2, the string was transferred aligned to the right and filled with
leading spaces during explicit data type conversion of SINT/INT/DINT/REAL_TO_STRING/
WSTRING in SCL.
Example: REAL_TO_WSTRING(12) = ' 1.200000E+1'
As of TIA Portal V13, the string is displayed with a leading sign during explicit data type
conversion of SINT/INT/DINT/REAL_TO_STRING/WSTRING in SCL and transferred aligned
to the left.
Example: REAL_TO_WSTRING(12) = '+1.200000E+1'
Reading an invalid peripheral input

In the TIA Portal as of version 12, the error code 16#2942 for the reading of an invalid peripheral
input is only output if you have programmed the faulty access in such a way that this becomes
effective, for example %MW10 := InvalidWordAccess":P, and does not lie within an irrelevant
sequence. For example, this would be #tmp := InvalidWordAccess":P, if the tag #tmp is not
used in the rest of the program block.
Instruction "S_CONV: Convert character string"

The EN/ENO mechanism behaves differently in TIA Portal V13 SP1 than in TIA Portal V13.
In version V13, the ENO enable output returns the signal state "0" in case of error, even if you
have deactivated the ENO enable output. If you have switched an additional instruction to the
ENO enable output, this is then not executed.
In version V13 SP1, the ENO enable output returns the signal state "1" in case of error, if you
have deactivated the ENO enable output. If you have switched an additional instruction to the
ENO enable output, this is then executed as expected.
Instruction "SET: Set bit array"

In the TIA Portal, you can also interconnect an element of a data block at the N parameter of
the SET instruction.
36
Readme
STEP 7 Professional
Instruction "MUX: Multiplex" (SCL)

Up to and including TIA Portal V13, the value of the tag at the input parameter was output
unchanged as a function value, even if the K parameter had a negative integer. This behavior
has changed in TIA Portal V13 SP1.
In TIA Portal V13 SP1, if you use a tag with a valid data type at the input parameters of the
MUX instruction and the K parameter is a negative integer, the value of the tag is changed.
You can find the valid data types in the description of the MUX instruction in the information
system.
Instruction "DEMUX: Demultiplex" (SCL)

Up to and including TIA Portal V13, no value was output at the OUTELSE output parameter if
the value of the K parameter was < 0. In contrast, the value of the IN input parameter was
output at the OUTELSE output parameter if the value of the K parameter was > available
outputs. This behavior has changed in TIA Portal V13 SP1.
In the TIA Portal V13 SP1, if you specify at the K parameter a value that is outside the available
outputs (K < 0 or K > available outputs), then the value of the IN input parameter is output at
the OUTELSE output parameter.
Instruction "MOVE: Move value" (STL) (S7-1500)

As of the TIA Portal V13 SP1, a stricter syntax rule applies to the "MOVE" instruction in STL:
Up to and including TIA Portal V13. it was possible to specify non-typed constants, such as
"0" at the input parameter IN.
If you want to copy, for example, the value "0" in the TIA Portal V13 SP1, you need to specify
a typed constant according to the data type of the output parameter (e.g. INT#0, DINT#0, etc.).
Instruction "Program_Alarm: Generate program alarm with associated values" (S7-1500)

As of TIA Portal V13 SP1 the data type INT is no longer permitted for use for the associated
values or an index tag of a text list. Use the UINT data type instead.
Instructions "READ_DBL: Read from data block in the load memory" and "WRIT_DBL: Write to data
block in the load memory"
TIA Portal V13 SP1 reports a compilation error if you use "READ_DBL" V1.0 or "WRIT_DBL"
V1.0 and access a data block with the attribute "Only store in load memory" using the parameter
DSTBLK.
Instead, use version 1.2 of both instructions.
"READ_DBL instructions: Read from data block in the load memory" and "WRIT_DBL: Write to data
block in the load memory" (SCL)
As of TIA Portal V13 SP1, the "READ_DBL" and "WRIT_DBL" instruction in SCL are subject
to the same strict syntax rules as all other programming languages:
Readme
37
STEP 7 Professional
In TIA Portal V13, it was possible to specify "standard" data blocks at the SRCBLK and
DSTBLK parameters that contained tags with different data types.
As of TIA Portal V13 SP1, the individual tags contained must have the same data type for both
"standard" as well as for "optimized" data blocks; otherwise, compiling errors are reported.
Function values (Return)

As of TIA Portal V13 SP1, more stringent syntax rules apply to function call:
It is checked that the function value (Return) is written in any case, even if multiple possible
program paths can be run through in the function. Therefore, there is no longer any risk that
the function values will accidentally not be written during runtime.
However, you may possibly receive syntax errors in functions during compiling, which it was
still possible to compile without errors in V13. In such cases change the program code so that
the function valve is written in all possible program paths.
Example:
SCL
IF #MyIn1 = #MyIn2 THEN
#Block_3 := #MyIn1 + 1;
END_IF;
In this example, the function value of "Block_3" is not written if the condition of the IF instruction
is not fulfilled. The function value then contains an undefined value.
SCL
#Block_3 := #MyIn1;
IF #MyIn1 = #MyIn2 THEN
#Block_3 := #MyIn1 + 1;
END_IF;
In this example the function valve of "Block_3" is definitely written in the program, since "MyIn1"
is set as default before the IF loop is completed.
Comparing the hardware data types HW_IO and HW_DEVICE

As of TIA Portal V13 SP1, there is a stricter syntax rule that is valid for the comparison of the
data types HW_IO and HW_DEVICE:
Up until and including TIA Portal V13 it was possible to compare the data types HW_IO and
HW_DEVICE directly with each other.
If you want to compare these data types in TIA Portal V13 SP1 you have to first create a tag
of the data type HW_ANY in the section "Temp" for the block interface and then copy the
LADDR (from data type HW_DEVICE) to the tag. It is then possible to compare HW_ANY and
HW_IO.
Implicit conversion of floating-point numbers to DWORD (GRAPH) (S7-1500)

As of TIA Portal V13 SP1 stricter syntax rules apply for the implicit conversion of floating-point
numbers to DWORD:
38
Readme
STEP 7 Professional
Up to and including TIA Portal V13, it was possible to convert a non-typed constant (e.g. 1.0)
implicitly to the data type DWORD if the value was less than 32 bits.
With TIA Portal V13 SP1, if you want to convert a floating-point number implicitly to the data
type DWORD, you can only use typed constants (e.g. REAL#1.0) since a non-typed constant
(e.g. 1.0) is interpreted as data type LREAL and can no longer be converted implicitly to
DWORD.
Assigning a value to a LTIME constant

As of the TIA Portal V13 SP1, a stricter syntax rule applies to the definition of a value to a
LTIME constant:
Up until and including TIA Portal V13 it was possible to assign a TIME value (e.g. T#10s) to a
LTIME constant.
If you want to assign a value to a LTIME constant in TIA Portal V13 SP1, you have to use
LTIME syntax (e.g. LT#10s).
Please note that the corresponding TIA Portal projects from previous versions already had to
have been adjusted before the upgrade to TIA Portal V13 SP1.
Indirect indexing of ARRAY components of data type bit string in SCL

In TIA Portal V13, you can address the components of an ARRAY for a CPU of the
S7-1200/1500 series in SCL with a tag of the data type BYTE, WORD, DWORD or LWORD
as index in addition to a tag of the integer data type if the IEC check is not set. This is not
possible for a CPU of the S7-300/400 series.
The result is an incompatibility with TIA Portal V12 SP1 in which indirect indexing with the data
type bit string is also permitted on a CPU of the S7-300/400 series.
Readme
39
STEP 7 Professional
2.5 Inter Project Engineering (IPE)
EN/ENO mechanism for STRING conversion

Conversion
Description
Strg_TO_Chars: Convert character string to Array

of CHAR
The ENO enable output returns the signal state "0"

even if you have deactivated the ENO enable out
put:
For an invalid character at the CHARS
parameter
For an invalid ARRAY index at the PCHARS
parameter
If the sum of the PCHARS and STRG
parameters exceeds the length of the target
ARRAY.
Chars_TO_Strg: Convert Array of CHAR to char

acter string
The ENO enable output returns the signal state "0"

even if you have deactivated the ENO enable out
put:
If the sum of the PCHARS and CNT
parameters exceeds the length of the source
ARRAY.
Overflow of the local data stack (S7-300/S7-400)

As of TIA Portal V13 SP1, the size of the local data stack is checked to ensure it does not
exceed what you have defined for the OB priorities in the hardware configuration.
This means that you may get error messages during compilation in projects that could be
compiled without errors in V13. If this happens, change the maximum size of the local data
stack in the hardware configuration.
2.5
Inter Project Engineering (IPE)
2.5.1
Notes on IPE
Content
Using system diagnostics in the device proxy

To use the "system diagnostics" function in an IPE device proxy, for example, a system
diagnostics view, insert the PLC alarms as content of a device proxy.
40
Readme
STEP 7 Professional
2.6 Technological functions
Connections to the SIMATIC S7-1500 software controller

Connections to the SIMATIC S7-1500 software controller as device proxy are only possible
via the interfaces assigned to the software PLC.
Support of Alarm_S alarms

The integrated configuration with WinCC and SIMATIC Manager support the Alarm_S alarms,
which are available via data blocks and Continuous Function Chart (CFC).
Compatibility
With TIA Portal V14, you can open the IPE files of the same version and the version V13 SP1.
The IPE files created with TIA Portal Version V14 cannot be opened with TIA Portal V13 SP1
and V13.
2.6
Technological functions
2.6.1
Notes on technological functions (S7-1500)
S7-1500 Motion Control - Effect of the "MasterSyncPosition" parameter on MC_CamIn (S7-1500T)

Use the "MasterSyncPosition" parameter to specify the starting position of the synchronous
operation in the cam relative to the start of the cam. If the entire cam is to be run, specify the
value 0.0 (default value) in "MasterSyncPosition".
The figure below shows the basic effect "MasterSyncPosition" parameter:
6ODYHYDOXHRIWKHV\QFKURQRXVRSHUDWLRQIXQFWLRQ
IROORZLQJD[LVSRVLWLRQ
6ODYHYDOXH
&DPGHILQLWLRQ
6ODYH2IIVHW
0DVWHU2IIVHW
0DVWHUYDOXH
0DVWHU6\QF3RVLWLRQ
&DPVWDUW
Readme
0DVWHUYDOXHRIWKHV\QFKURQRXVRSHUDWLRQIXQFWLRQ
OHDGLQJD[LVSRVLWLRQ
6WDUWV\QFKURQRXVRSHUDWLRQ
41
STEP 7 Professional
You can find an FAQ entry with more information in the Internet (https://
support.industry.siemens.com/cs/ww/en/view/109740188).
S7-1500 Motion Control - Settings for the continuity in the cam editor (S7-1500T)
The settings in the cam editor in the configuration window "Properties (Inspector window) >
Profile > Default optimization settings" apply to the VDI-based optimization and the system
interpolation of transitions.
In the cam editor, the warnings for the calculation of the effective curve is displayed with a
warning triangle . Warning messages related to the continuity for system interpolation may
only disappear when you adapt the continuity requirement in the "Default optimization settings"
configuration window.
S7-1500 Motion Control - Override response for MC_Home (S7-1500T)

Contrary to the override response in the documentation, a new "MC_Home" job does not abort
an active synchronous operation job with "MC_GearInPos"/"MC_CamIn". When synchronous
operation is running with "MC_GearInPos"/"MC_CamIn", a new "MC_Home" job is declined
with the error ID 16#80A1.
The following table shows the corrected entry for "MC_Home" from the section "Programming
the PLC > Instructions > Instructions (S7-1200, S7-1500) > Technology (S7-1200, S7-1500)
> Motion Control (S7-1200, S7-1500, S7-1500T) > Motion Control (S7-1500, S7-1500T) >
S7-1500 Motion Control V3 (S7-1500, S7-1500T) > Override response of Motion Control
commands V3 (S7-1500, S7-1500T)":
Active job
MC_Gear
In
New job
MC_Home Mode = 3, 5
MC_Gear
InPos
pending
MC_Gear
InPos ac
tive
(Busy =
TRUE,
InSync =
FALSE,
StartSync
= FALSE)
(Busy =
TRUE,
StartSync
or InSync =
TRUE )
MC_Phas
ing
Absolute
MC_Phas
ing
Relative
MC_Ca
mIn pend
ing
(Busy =
TRUE,
InSync =
FALSE,
StartSync
= FALSE)
MC_Ca
mIn active
(Busy =
TRUE,
StartSync
or InSync =
TRUE )
A The current job is aborted with "CommandAborted" = TRUE. The current dynamics is smoothly transitioned to the dynamic
values of the new job.
- No effect, running job continues to be executed
S7-1500 Motion Control - MC_SynchronizedMotionSimulation (S7-1500T)

To start an "MC_SynchronizedMotionSimulation" job, synchronous operation must be running
at the technology object with the "Synchronous" status (<TO>.StatusWord.X22 = TRUE).
S7-1500 Motion Control - Synchronization using dynamic parameters (S7-1500T)

Contrary to the characteristics in the documentation for synchronizing through the dynamic
parameters, the following reaction occurs when the axes are at the synchronous positions:
42
Readme
STEP 7 Professional
If the leading and following axes are at the respective synchronous positions at the start of the
corresponding Motion Control command, the "Synchronous" status is set immediately.
When the leading axis is in its synchronous position when the corresponding Motion Control
job is started, the leading axis must first cross the start position to start synchronization.
S7-1500 Motion Control - Using multiple encoders in simulation mode or with SIMATIC S7-PLCSIM
(S7-1500T)
To use a technology object in simulation mode (virtual axis/simulation) or with SIMATIC S7PLCSIM, you need to use encoder 1 for position control of the axis.
S7-1500 Motion Control - Automatic transfer of drive and encoder parameters in the device
Successful transfer of the parameters can be checked in the controller in the tags of the
technology objects <TO>.StatusDrive.AdaptionState = 2 and
<TO>.StatusSensor[n].AdaptionState = 2.
S7-1500 Motion Control - "ReferenceMarkPosition" parameter at MC_Home

The "ReferenceMarkPosition" parameter shows the position at which the technology object
was homed (homing mark), valid for "Done" = TRUE.
However, in TIA Portal V14 (S7-1500 Motion Control V3.0), the "ReferenceMarkPosition"
parameter shows the position at which the technology object was homed (homing mark), plus
the configured home position offset (<TO>.Sensor[n].ActiveHoming.HomePositionOffset).
If you configure a home position offset 0.0, you cannot use the "ReferenceMarkPosition"
parameter of the "MC_Home" Motion Control instruction.
S7-1500 Motion Control - Virtual axis/simulation

In contrast to the documented behavior, the "Simulation" configuration can only be changed
by a new download to the CPU (in STOP mode) (<TO>.Simualtion.Mode).
S7-1500 Motion Control - Sign-of-life failure with reduced application cycle of MC-Servo [OB91]
If you call the application cycle of the MC-Servo [OB91] reduced to the send clock of a
PROFINET IO system and the technology alarm 431 (Signs of life of drive faulty) is repeatedly
shown, increase the update time of the send clock.
S7-1500 Motion Control - Changing cam track during runtime

If you change a cam track with "MC_CamTrack.Mode" = 1 during runtime of the user program,
keep in mind the lead time of the cam track as reserve for the first output cam. Define the first
output cam position in the cam track only after the following position:
Position of first output cam > velocity of axis x lead time of the cam track
(<TO>.Parameter.OnCompensation)
Also keep in mind the internal system time for output cam calculation, even if you set the lead
time 0.0.
Readme
43
STEP 7 Professional
S7-1500 Motion Control - Additional remedies for technology alarms

Technology
alarm
Alarm text
Remedy
106
Drive connection configuration er

Ensure that the communication between the controller and drive is es
ror. Drive not initialized during ramp- tablished. To do this, evaluate <TO>.StatusDrive.CommunicationOk
up.
before enabling the axis.
108
Encoder connection configuration

error. Encoder not initialized during
ramp-up.
Ensure that the communication between the controller and encoder is

established. To do this, evaluate <TO>.StatusSensor[1..4].Communi
cationOk before enabling the axis and also check if the status of the
encoder actual value is <TO>.StatusSensor[1..4].State = VALID (2).
552
Adaptation error of encoder during

power-up. Encoder is not assigned
to a SINAMICS device.
The operationally active encoder could not be adapted. However, there

are other encoders that can be used. Use the encoder switch (MC_Set
Sensor).
S7-1500 Motion Control - Alarm reaction to technology alarm 603

Technology
alarm
603
Alarm text
Leading axis is not in position-con
trolled mode.
Reaction
Error bit
Remove enable
X14
S7-1500 Motion Control - Measuring input with SIMATIC S7-PLCSIM

The measuring input technology object cannot be used with SIMATIC S7-PLCSIM. The
measuring input technology object and the measuring input jobs used in the user program can
be loaded into SIMATIC S7-PLCSIM, but have no function. Measured values are not shown.
S7-1500 Motion Control - Temporal requirements for measuring jobs via "MC_MeasuringInput"
The hardware-related restrictions to measurement via the PROFIdrive telegram or measuring
via the SINAMICS measurement sensing input, there are time requirements for the period until
the measuring event can be recorded.
When measuring once via "MC_MeasuringInput" with mode 3 (measurement at both edges,
beginning with the rising edge) or mode 4 (measurement at both edges, beginning with the
falling edge), a minimum interval of several servo cycles is therefore required between the first
edge to be measured and the previous edge, in order for the first edge to be measured can
be recorded.
You can find information on the time conditions in the section "Using technology function >
Motion Control > Motion Control (S7-1200, S7-1500, S7-1500T) > Using S7-1500 Motion
Control (S7-1500, S7-1500T) > Technology objects (S7-1500, S7-1500T) > Technology object
measuring input (S7-1500, S7-1500T) > Time-related boundary conditions (S7-1500,
S7-1500T)".
44
Readme
STEP 7 Professional
S7-1500 Motion Control - Changing the configuration offline

If you change the configuration of the axis offline and download the CPU in RUN operating
mode, the modified parameters are displayed, but only take effect after the technology object
has been restarted.
To do this, call MC_Reset with Restart = TRUE.
S7-1500 Motion Control and S7-1200 Motion Control

S7-1200 Motion Control and S7-1500 Motion Control are different. The operating modes of
the motion control instruction MC_Home are not compatible.
You have to modify your user program. Programs which are transferred to another CPU series
always have to be recommissioned.
S_USSI on S71500
Note the following when using the instruction S_USSI of the distributed I/O ET 200S 1SI on
an S71500.
The parameter ANZ shows the value 0 even in the case of an error.
If the CPU is switched to stop with the S_USSI instruction, check all possible errors listed at
the parameter ANZ.
PtP module with CM 1243-5 PROFIBUS Master

You have to make the following settings in the instance DB of the instructions when using the
PtP modules CM PtP RS232 BA, CM PtP RS422/485 BA, CM PtP RS232 HF, CM PtP
RS422/485 HF and CM PtP with a CM 1243-5 PROFIBUS Master with firmware V1.3.4:
Send_P2P
max_record_len = 240
Modbus_Master
Send_P2P.max_record_len = 240
Modbus_Slave
Readme
45
STEP 7 Professional
PID_Temp on CPU 1500 V1.7

Note the following when using PID_Temp on a CPU 1500 with firmware version V1.7:
The integrated dead zone in PID_Temp must not be used on CPU 1500 V1.7.
Do not change the preset 0.0 of the associated parameters
Retain.CtrlParams.Heat.DeadZone and Retain.CtrlParams.Cool.DeadZone.
If the cooling output is active (PidOutputSum < 0.0, OutputCool <> 0.0) for a closed loop
controller with active cooling and PID parameter switchover (Config.ActivateCooling =
TRUE, Config.AdvancedCooling = TRUE) while "Pretuning cooling" is started (Mode = 1,
Heat.EnableTuning = FALSE, Cool.EnableTuning = TRUE), aborts with error ErrorBits =
16#0040_0000.
In this case use "Fine tuning cooling" (Mode = 2, Heat.EnableTuning = FALSE,
Cool.EnableTuning = TRUE)
or
Before starting the pretuning, switch to manual mode with a manual value larger than
0.0 (Mode = 4, ManualValue 0.0).
As of firmware version V1.8, these two restrictions no longer apply.
See also
FAQs with remedies for technology alarms (http://support.automation.siemens.com/WW/view/
en/66958052)
2.6.2
Notes on technological functions (S7-1200)
S7-1200 Motion Control - variable <axis name>.StatusBits.NonPositionControlled

Contrary to the information in the online help, the content of the variable <axis
name>.StatusBits.NonPositionControlled has the following significance:
Position control enabled
FALSE = The axis is in position-controlled mode.
TRUE = The axis is in non-position-controlled mode.
S7-1200 Motion Control - Data connection for PROFIdrive drives and PROFIdrive encoders through a
data block
Compile the data block for the data connection before you use it in the configuration of the
axes. The required offset addresses are calculated this way.
S7-1200 Motion Control - "ReferenceMarkPosition" parameter at MC_Home

The "ReferenceMarkPosition" parameter shows the position at which the technology object
was homed (homing mark), valid for "Done" = TRUE.
46
Readme
STEP 7 Professional
However, in TIA Portal V14 (S7-1200 Motion Control V6.0), the "ReferenceMarkPosition"
parameter shows the position at which the technology object was homed (homing mark), plus
the configured home position offset (<TO>.Sensor[n].ActiveHoming.HomePositionOffset).
If you configure a home position offset 0.0, you cannot use the "ReferenceMarkPosition"
parameter of the "MC_Home" Motion Control instruction.
PtP module with CM 1243-5 PROFIBUS Master

You have to make the following settings in the instance DB of the instructions when using the
PtP modules CM PtP RS232 BA, CM PtP RS422/485 BA, CM PtP RS232 HF, CM PtP
RS422/485 HF and CM PtP with a CM 1243-5 PROFIBUS Master with firmware V1.3.4:
Send_P2P
max_record_len = 240
Modbus_Master
Modbus_Slave
2.6.3
Notes on technological functions (S7-300/400)
Parameter assignment for the FM x51 and FM x52

In contrast to the information in the Online Help, if you change the measuring system, the
previously entered parameter values are not converted to the new measuring system.
Programming FM x50-1, FM x51 and FM x52

The "initial values" specified in the parameter tables in the online help regarding the instructions
correspond to the "default value" in the software interface of the user programming.
IM 174 migration
During the migration of projects with IM 174, the parameter assignment of IM 174 is set to
default values. It is absolutely necessary to set parameters for IM 174 again after the migration.
Readme
47
STEP 7 Professional
48
Readme
WinCC Basic
3.1
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement and continuously maintain a holistic, state-of-the-art industrial
security concept. Siemens products and solutions only form one element of such a concept.
Customer is responsible to prevent unauthorized access to its plants, systems, machines and
networks. Systems, machines and components should only be connected to the enterprise
network or the internet if and to the extent necessary and with appropriate security measures
(e.g. use of firewalls and network segmentation) in place.
Additionally, Siemens guidance on appropriate security measures should be taken into
account. For more information about industrial security, please visit
Siemens products and solutions undergo continuous development to make them more secure.
Siemens strongly recommends to apply product updates as soon as available and to always
use the latest product versions. Use of product versions that are no longer supported, and
failure to apply latest updates may increase customers exposure to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS
Feed under
Passwords
Various passwords are set by default in WinCC. For security reasons, you should change
these passwords.
For the user "Administrator", the default password is "administrator".
Communication via Ethernet

In Ethernet-based communication, end users themselves are responsible for the security of
their data network. The proper functioning of the device cannot be guaranteed in all
circumstances; targeted attacks, for example, can lead to overload of the device.
Readme
49
WinCC Basic
3.2 News
Network settings
The following tables show the network settings of each product which you need in order to
analyze the network security and for the configuration of external firewalls:
WinCC Basic (without simulation)
Name
Port num Transport

ber
protocol
Direction
Function
Description
ALM
4410*
TCP
Inbound,
Outbound
License service
This service provides the complete functionali

ty for software licenses and is used by both the
Automation License Manager as well as all li
cense-related software products.
HMI Load
1033
TCP
Outbound
HMI Load
(RT Basic)

WinCC Simulation for Basic Panels

Name
Port num Transport

ber
protocol
Direction
Function
Description
HMI Load
1033
TCP
Inbound
HMI Load
(RT Basic)

EtherNet/IP
44818
TCP
Outbound
Ethernet/IP
channel

2222
UDP
Inbound
Ethernet/IP
channel

Modbus TCP
502
TCP
Outbound
Modbus TCP
channel
The Modbus TCP protocol is used for connec

tions to Schneider PLCs.
RFC 1006
102
TCP
Outbound
S7 channel
Communication with the S7 controller via

Ethernet/PROFINET
Mitsubishi MC
5002
TCP
Outbound
Mitsubishi MC
channel
The Mitsubishi protocol is used for connections

to Mitsubishi PLCs.
3.2
News
News about the TIA Portal

You can learn about the latest news about various topic areas of the TIA Portal in Siemens
Industry Online Support.
All news concerning WinCC can be found here: News (http://support.automation.siemens.com/
WW/view/en/88360672)
50
Readme
WinCC Basic
3.3 Notes on use
3.3
Notes on use
Contents
product features.
Virus scanners during installation

Virus scanners should be disabled during the installation of WinCC.
Change in response after upgrading

The new WinCC version contains new features and improvements as compared to the previous
version. The new version may therefore demonstrate slight differences in the names or the
response of properties and functions after the upgrade. Unlike in previous versions, the
standard properties of newly created objects can also be changed.
These differences in response may lead to errors when compiling the project.
Working with styles

Please note that the system styles are reset to the default style "WinCC Dark" after upgrading
the project to V14.
To restore the system style that you had set before upgrading the project, follow these steps:
1. Open the Runtime settings of the HMI device.
2. Select the desired system style under "Style of the HMI device".
Compatibility with WinCC V13

In WinCC V14, it is not possible to save the project in the WinCC V13 format.
Specifying the time of modification in the overview window

The times of modification displayed in the overview window only refer to changes to the object
itself. Changes to subordinate objects, e.g. screen objects in a screen, do not cause the time
of the last change to the screen to change in the overview window.
Installing East Asian project languages on a PC without Asian operating system

If you select an East Asian project language on a PC that does not have an Asian operating
system installed, the default font is marked as invalid in the "Runtime settings > Language &
font" editor.
To resolve this problem, open the "Regional and Language Options > Languages" dialog in
the Control Panel and enable the "Install files for East Asian languages" option.
Readme
51
WinCC Basic
3.4 Migration
Compatibility of WinCC V14 with SCOUT TIA

WinCC V14 is not compatible with SCOUT TIA versions lower than V4.5. Version V4.5 will be
released soon.
3.4
Migration
Contents
product features.
Project languages in WinCC

WinCC V14 does not support all project languages that were available in WinCC flexible, such
as Arabic. If you receive an empty project as the result of your migration, you may want to
check the set editing language. Do not set the project languages that are not supported as
editing language in the source project. Proceed as follows:
1. Open the project with WinCC flexible.
2. Change the editing language to English, for example.
3. Save the project.
4. Restart the migration.
Migrating an integrated project with ProTool objects

The "PROTOOL option package(s) missing in STEP 7" error message output during migration
of a WinCC flexible project that is integrated in STEP 7 indicates that WinCC flexible 2008
SP3 is installed on your system. Moreover, the project still contains objects that were
configured using ProTool. Do not open the project with WinCC flexible 2008 SP3! To migrate
the project, proceed as follows:
1. Open the project in the SIMATIC Manager.
2. Execute the "Save as" command in the "File" menu.
3. Enable the option "With reorganization" in the "Save project as" dialog.
4. Click OK.
5. Copy the project back to the original computer.
6. Restart the migration.
Migrating a WinCC V7 project: Border line of rectangles

In a WinCC V7 project, you have configured a rectangle with the settings "Line weight = 1"
and "Draw insider border = yes".
52
Readme
WinCC Basic
3.4 Migration
Migrate the WinCC V7 project to WinCC V14. To have the rectangle displayed correctly, follow
these steps.
1. Open the Inspector window of the rectangle.
2. Open the property list.
3. Disable "Widen border line inwards".
Progress bar
As long as the progress bar still shows a value of 100%, the software is still busy running
remaining tasks such as the closing of references. The software will not respond to user input
while this status is given.
Migrating projects from WinCC V7

In TIA Portal V13, you can continue to use projects from WinCC V7.2 after migration. Projects
from earlier WinCC versions cannot be migrated directly to WinCC TIA Portal version V13. If
you wish to continue using such projects in TIA Portal V13, you must first migrate them to the
WinCC V7.2 Classic page. To do so, use WinCC V7.2 with the latest update.
Supported project languages in WinCC V7

Due to different Windows DotNet versions, there may be different names in WinCC V7 and
the TIA Portal within the same language. This may result in different sorting orders in the same
project.
The following table shows some examples with English spelling:
WinCC V7.x
TIA Portal
Bengali (Bangladesh)
Bangla (Bangladesh)
Bengali (India)
Bangla (India)
Chinese (Simplified, PRC)
Chinese (People's Republic of China)
Chinese (Simplified, Singapore)
Chinese (Singapore)
Chinese (Traditional, Hong Kong S.A.R)
Chinese (Hong Kong S.A.R)
Chinese (Traditional, Macao S.A.R)
Chinese (Macao S.A.R)
Chinese (Traditional, Taiwan)
Chinese (Taiwan)
French (Monaco)
French (Principality of Monaco)
Oriya (India)
Odia (India)
Sami (Inari, Finland)
Sami, Inari (Finland)
Sami (Skolt, Finland)
Sami, Skolt (Finland)
Sami, Northern (Norway)$Sami
Sami, Northern (Norway)
Spanish (Bolivarian Republic of Venezuela)
Spanish (Venezuela)
Spanish (Spain, Traditional Sort)
Spanish (Spain)
Spanish (Spain, International Sort)
Spanish (Spain)
Yakut (Russia)
Sakha (Russia)
Readme
53
WinCC Basic
3.5 Engineering System
3.5
Engineering System
3.5.1
Screens and Screen Objects
Contents
product features.
Screen objects after HMI device replacement

If you upgrade a device to the new HMI device versions, you should check the screens
contained in the project. Because of the new appearance and improved operability, texts of
symbolic I/O fields may not be completely legible and may be concealed by operator controls.
Grouping of screen objects

When you group screen objects in WinCC, performance problems can arise in WinCC in the
case of large nesting depths.
ActiveX and .NET controls

ActiveX and .NET controls are always positioned in the foreground in runtime.
The configuration of ActiveX and .NET controls on levels is not supported.
Use of bitmaps as icons

In Windows 8 and Windows 8.1, the use of bitmaps with a size of 48x48 pixels and a color
depth of 32 bits as icons is not supported.
Border line of rectangles

In a WinCC V7 project, you have configured a rectangle with the settings "Line weight = 1"
and "Draw insider border = yes".
You then migrate the WinCC V7 project to WinCC V12. To have the rectangle displayed
correctly, follow these steps.
1. Open the Inspector window of the rectangle.
2. Open the property list.
3. Disable "Widen border line inwards".
Border line of "Graphic I/O field" object

In WinCC V14, the dynamization of the border line of the "Graphic I/O field" object in "Two
states" mode has no effect during runtime.
54
Readme
WinCC Basic
Dynamization of instances of a faceplate type in a group

You are using the instance of a faceplate type in an object group. The properties of the instance
are also displayed as properties of the group. Any dynamization with tags, scripts or animations
of the group is not displayed in Runtime.
Preview in screen window

You use your own designs with shadows for screen objects. The screen objects can be
displayed in a screen window.
The shadows of the screen objects are not displayed in the preview of the screen window. The
response occurs only in the engineering system. It is displayed correctly in Runtime.
Many visually different screen objects

The use of screen objects with many visually different properties (e.g. many different styles)
can reduce performance in runtime and can increase the amount of available memory space
used. Avoid using, for example, very many different corner radii: 0 pixel, 1 pixel, 2 pixels, 3
pixels, etc.
Dynamization of grouped objects (RT Professional)

For groupings with multiple nestings (group in group, faceplate in group, group in faceplate,
etc.), only the events of the outermost group and the innermost objects can be used for
dynamization with system functions. System functions that are configured at events of the
lower-level group or lower-level faceplate are not executed.
Number of characters in text fields, lists and alarm texts

The number of characters that can be used in the text of a screen object is not constant. Control
instructions and formatting are taken into consideration when entering text data and the
maximum number of characters is reduced accordingly.
Transparency in WinCC as of V13

Transparent graphics can be displayed without any problems in Runtime. This is true for all
Comfort Panels and WinCC Runtime Advanced as of version 13.0.
To use the transparency in a graphic view or in a graphic I/O field, the "Fill pattern" property
must be set to "Transparent" and the property "Use transparent color" must be disabled.
If the property "Use transparent color" is enabled in a device as of version 13.0, the
transparency of the graphic is lost and the transparent pixels are displayed in black. We
recommend that you check the "Use transparent color" property at the points of use of
transparent graphics after upgrading existing projects to device version 13.0 or higher. If the
graphics are not displayed correctly, disable this property.
Displaying SIMOTION PLC websites in the HTML browser

If the SIMOTION PLC websites are not displayed correctly in the HTML browser, insert ""/
basic"" after the website URL to display the websites in basic mode.
Readme
55
WinCC Basic
Display differences between the configuration and the display on the HMI device
The display of the text configured in a screen object may be different on the HMI device due
to the display configuration. If you are using the options for automatic size adjustment in the
configuration, check the display on your HMI device in every language.
If texts that were configured with the "Fit object to contents" option cannot be displayed in full,
they are reduced slightly on the HMI device. If this reduction leads to a distorted display of
texts, disable the "Fit object to contents" option and expand the text with additional blanks.
Optionally, you can increase the width of the object or use a shorter formulation for the text.
Exporting and importing function keys

Function keys are synchronized during the import. If a function key is created in the global
screen and the key is empty in the screen, the corresponding function key will use the global
definition in all screens.
If you want to disable the global use of function keys after the import, define empty keys in the
screens and import the screen types in the following order: Global screen, templates, screens.
If you want to ensure when exporting the screens that the global definition of a function key is
not used by the template or by the global screen, create an empty function key in the screen.
Select the required function key in the screen, then enable the "Use global assignment"
property and disable it again.
Corner radius of the "Symbolic I/O field" object

The "corner radius" property is not available for a symbolic I/O field on Comfort Panels or RT
Advanced.
The corner radius that you specify for the "Symbolic I/O field" object in the style editor has no
effect in the screen editor for these target systems.
PLC Code Viewer

The following data types are not supported by the PLC Code Viewer:
Date and time: DATE, TOD, LTOD, DT, LDT
Characters: CHAR, WCHAR, STRING
Complete DTL structures are not supported. Only single elements of DTL structures are
supported.
Jump from a monitoring alarm to the PLC code view
For the jump from a monitoring alarm to the PLC code view, the instance name must conform
to the following naming convention <FB name>_DB when using supported local operands in
a function block.
Note: The jump to a function or an organization block is only possible if only global operands
are used.
56
Readme
WinCC Basic
The following restrictions apply to viewing upstream networks:
The upstream network must not contain any tags from the Temp or InOut section of an FB.
The following data types may not be used for tags:
STRING
WSTRING
CHAR
WCHAR
S5TIME
No array element may be used with a tag to be used as an index.
Only bit slicing is supported for slice access.
Special features: Operands and UDTs
Operands that are declared in the "#Temp" or "#InOut" area are generally not supported by
the PLC code view. This applies both to elementary data types and to data types that are
contained in UDTs.
Data types of a UDT can be declared in the "#In" and "#Out" area and displayed in the PLC
code view. The same limitations as for elementary data types apply to the data types of the
UDT.
Faceplates for Runtime Advanced

When configuring styles at the faceplate type, the "Use style/design" property has to be
available in the interface before the "Style item design" property is used in the interface of the
faceplate. Otherwise, the style at the instance of the faceplate is lost when the configuration
is updated.
GRAPH overview for Runtime Professional

When upgrading to V14, the signature of the C function at the "Click" event is changed. The
propertyName parameter from the previous versions has been removed. Functions that are
able to access this parameter are shown as faulty after the upgrade.
Updating faceplates with the UDTs of the type "IEC timer"

The "ST" element was automatically removed from the user-defined PLC data types (UDT)
that use the "IEC timer" data type. Adapt the faceplates containing these UDTs to a new version
of the UDT without an ST element.
A detailed description of this can be found in the FAQ with the entry ID "109740393" in the
SIMATIC Customer Online Support.
Readme
57
WinCC Basic
Dynamizing the value column in the table view (RT Professional)

Note the following information about dynamizing the properties in the value column of a table
view:
The "ValueColumnName" property specifies the name of the selected value column. The
"ValueColumnName" attribute can be dynamized with the "ValueColumnRename"
attribute. The data type is STRING.
The "ValueColumnRename" property changes the name of the value column referenced
with the "ValueColumnIndex" attribute. The attribute can be dynamized with the
"ValueColumnRename" name. With "ValueColumnRename" you also dynamize the
"ValueColumnName" attribute. The data type is STRING.
The "TimeColumnName" property specifies the name of the selected time column. The
"TimeColumnName" attribute can be dynamized with the "TimeColumnRename" attribute.
The data type is STRING.
The "TimeColumnRename" property changes the name of the time column referenced with
the "TimeColumnIndex" attribute. The attribute can be dynamized with the
"TimeColumnRename" name. With "TimeColumnRename" you also dynamize the
"TimeColumnName" attribute. The data type is STRING.
See also
http://support.automation.siemens.com (http://support.automation.siemens.com/WW/view/en/
62101921)
3.5.2
Tags and connections
Contents
product features.
Multiplexing tags on a Basic Panel

If you multiplex a tag with an external tag on a Basic Panel, the address is read from the PLC
in runtime during the first read cycle. The value of the address read is not available until the
second read cycle.
Tag names in faceplates

Use of the "." or "@" character in names of tags in faceplate types is not permitted. Do not use
these special characters in the tag names in faceplates.
Tags with symbolic addressing and "Char Array" data type (RT Professional)
Tags with symbolic addressing and the "WString" data type are not released for communication
of RT Professional and SIMATIC S7-1200 V3.
58
Readme
WinCC Basic
Length specification for tags of the "String" type

The length specification for the internal HMI tags of the "String" type have no effect in the "Tag"
editor. If you want to limit the tag length of an input field or output field, for example, limit the
length using VB scripting or C scripting.
Tags under "Tag box ID"

The tag that you configure under "Tag box ID" with "Runtime Settings > General" may only be
used in read-only mode.
No values may be written in this tag, however, they may be read in scripts, for example, or
output to screens.
Array elements in WinCC

If you have connected an HMI tag with an array from a STEP 7 data block which does not start
with a low limit of 0, the array elements are mapped in WinCC to the low limit of 0.
To ensure that you do not have to rethink between the STEP 7 indices and the WinCC indices
when accessing the individual array elements, the low limits of arrays should also start at 0 in
STEP 7.
Duration of the initialization of historical data

Initialization of the archives on some storage media can take up to 5 minutes. The successful
completion of initialization is confirmed by a system message once it has been completed. If
there a lack of any storage medium for archiving when Runtime starts, the appearance of the
system message can also take up to 5 minutes.
PLC user data types

When you access an element of a PLC user data type in a tag table via the object list instead
of the name of the PLC tags, the name THIS is inserted. You must replace this label with the
name of the PLC tag.
3.5.3
Alarm system and alarm displays
Contents
product properties.
Tags in alarm texts of Runtime Advanced

Tags of data type WChar or WString cannot be displayed in the alarm view in Runtime
Advanced.
Readme
59
WinCC Basic
Boolean tags in alarm logs

Bool type tags are recognized as 0 and -1 in the alarm log. If you use a text list that is controlled
by a tag of the type Bool in an alarm log, then add the entry for the value -1 to the corresponding
text list.
Duration of the initialization of historical data

Initialization of the archives on some storage media can take up to 5 minutes. The successful
completion of initialization is confirmed by a system message once it has been completed. If
there a lack of any storage medium for archiving when Runtime starts, the appearance of the
system message can also take up to 5 minutes.
PLC alarms
A PLC alarm is only visible in the "Alarm" editor of an HMI device when the FB calls for this
alarm have been invoked in an OB.
3.5.4
System functions
Content
product properties.
The "SimulateTag" system function on Basic Panels

If you use the system function "SimulateTag" with a short cycle time on a Basic Panel, the HMI
device may be overloaded.
3.5.5
Recipes
Contents
product features.
Arrays in recipe elements

If you have configured both an array as well as the elements of this array for recipe elements
of a recipe, the loading of data records aborts with the following error message: "290055: Import
of data records aborted with error"
Use either the array or just the array elements for recipe elements of a single recipe.
60
Readme
WinCC Basic
Saving recipes on Comfort Panels

Recipes should be preferably saved on the SD card rather than in the built-in flash memory.
3.5.6
User administration
Contents
Information that could no longer be included in the online help and important information about
product features.
3.5.7
Communication
Contents
product features.
Connection interruptions with Mitsubishi PLCs

After multiple connection interruptions, a situation may arise where all the connection
resources of the Mitsubishi PLC are in use and the connection can no longer be established.
We recommend that you check these connection resources in the PLC program of the
controller and enable them again.
Limited number of possible HMI connections

An error message is displayed during compilation of a device indicating that the configuration
of the HMI connection in the "Devices & Networks" editor is invalid. The reason may be that
the maximum number of possible connections of the HMI device or PLC has been exceeded.
Check the maximum number of available connections. Consult the device manuals of the
devices you are using.
Use of PROFINET IO with panel HMI devices

When using PROFINET IO to connect the direct keys and LEDs of HMI devices to the PLC,
you can define an offset for the address area of the inputs and outputs during configuration in
HW Config.
The following restriction applies when a PROFINET IO-capable S7-400 CPU is used with one
of the HMI devices listed below:
The offset for the start of the address area of the inputs must not be greater than the offset for
the start of the address area of the outputs.
Readme
61
WinCC Basic
The restriction applies to the following HMI devices:
OP 177B
OP 277
Mobile Panel 177
To configure the address parameters, open the PLC that contains the CPU of the 400 series
in HW Config. Select the HMI device that is connected via PROFINET IO from the station
window of HW Config. A table with the properties of the HMI device is displayed at the bottom
of the station window in the detail view. Select the line containing the addresses of the HMI
device in the table and open the object properties using the shortcut menu.
Enable the "Addresses" tab in the "Object properties" dialog. Configure the offset for the inputs
under "Inputs > Start". Configure the offset for the outputs under "Outputs > Start".
Changing IP settings and device name of a PLC in the Control Panel of the HMI device
The Control Panel is open in the "Service and Commissoning > IP-Adaptation" menu on the
HMI device. If you want to change the IP settings or the device name of a PLC, note the
following:
In the Engineering System, you need to have activated the following options in the Inspector
window of the PLC under "Properties > General > PROFINET interface > Ethernet addresses"
beforehand:
- "Set IP address using a different method" and
- "Set PROFINET device name using a different method".
HMI connections in WinCC V14

HMI connections to SIMATIC S7-1200 controllers with firmware versions earlier than V2.0 are
not possible in WinCC V14.
Connections via PROFIBUS DP

When a connection between a PLC and an HMI device via PROFIBUS DP is interrupted and
then re-established, sporadically all other PROFIBUS DP connections in the communication
network are interrupted and re-established.
De-energize the disconnected station before reconnecting it.
"Set the IP suite (address) of the PLC in the Control Panel" with SIMATIC S7-1200 V1
The function "Set the IP suite (address) of the PLC in the Control Panel" has not been approved
for the following PLCs:
SIMATIC S7-1200 V1
Switching a connection
A connection may be interrupted when it is switched from an HMI device to a SIMATIC
S7-300/400, to a SIMATIC S7-1500 or to a SIMATIC S7-1200 PLC.
62
Readme
WinCC Basic
3.6 System-wide functions
Note the following settings in the SIMATIC S7-1500 or SIMATIC S7-1200 controllers:
Absolute addressing of tags
The "Disable PUT-GET communication" option must be selected
The "Complete protection" protection level may not be set
Raw data communication in redundant projects

Simatic.NET, Named Connections and various communication blocks, such as BSEND/BRCV,
for example, can only be used to a limited extent in a redundantly configured PC station
because the connection parameters for the redundant partner server cannot be configured.
Getting diagnostics data by means of HMI devices

In contrast to the description of diagnostics icons for modules and devices in the information
system, the following icon has the meaning specified here for HMI devices:
Icon
Meaning
No diagnostics data is available.
Enabling/disabling a connection in Runtime (Basic 2nd Generation)

Contrary to the description in the online help, the alarms of the respective controller are
displayed after a connection is disabled. The system diagnostics for this controller is also
available.
3.6
System-wide functions
Contents
product features.
Using system diagnostics in the device proxy

To use the system diagnostics function in an IPE device proxy, for example, a system
diagnostics view, insert the PLC alarms as content of a device proxy.
Initialize device proxy with data from a V13 project

You cannot initialize a device proxy with data from a V13 project in a project with the version
V13 SP1.
Upgrade the V13 source project to version V13 SP1 to initialize the device proxy in the target
project with the data from the source project.
Readme
63
WinCC Basic
3.7 Compiling and loading
3.7
Compiling and loading
Contents
product features.
Compiling and loading

If internal errors or warnings occur during compiling, compile the complete project using the
command "Compile > Software (rebuild all)" in the shortcut menu of the HMI device.
Before you start productive operation with your project, compile the entire project using the
"Compile > Software (rebuild all)" command from the shortcut menu of the HMI device.
If you are using HMI tags that are connected to control tags in your project, compile all modified
blocks with the command "Compile > Software" in the shortcut menu before you compile the
HMI device.
Incorrect installation of ProSave

If you receive an error message during installation of ProSave when loading data to a target
device or maintenance of an HMI device, then you cannot remedy this error using the repair
function of setup. Remove ProSave via the Control Panel. Then start setup and install the
"ProSave" component again.
Checking the address parameters

During compilation of an HMI device in the project tree with the command "Compile > Software"
in the shortcut menu, the address parameters of the HMI device, such as the IP address, will
not be checked. If you want to ensure that the address parameters are checked as well, you
will have to compile the HMI device using the "Compile" button in the "Devices & Networks"
editor of the toolbar.
Error message when downloading data to the PLC

A panel and a PLC are connected and communicating with other.
If a tag is accessed while downloading data from the panel to the PLC, an error message is
displayed on the panel.
Delayed reaction in the "Extended download to device" dialog

If the settings in the "Extended download to device" dialog for "Type of the PG/PC interface"
and "PG/PC interface" do not match the settings on the HMI device, this can result in the
application not responding for up to a minute.
64
Readme
WinCC Basic
3.7 Compiling and loading
Extended download with an S7-1200 and a Comfort Panel

An S7-1200 PLC and a Comfort Panel are located in the same physical network as the PG/
PC. You open the "Extended download to device" dialog for the Comfort Panel.
If you enable the option "Show all accessible devices", it may occur that the application stops
responding.
OP77A, OP73, TP177A: Loading projects

When loading a project to an HMI device, it can happen that Runtime is not automatically
ended, even though "Remote Transfers" is activated in the Panel.
If this happens, stop Runtime and manually set the transfer mode on the HMI device.
Project transfer via USB

If you have connected more than one HMI device via USB to your configuration PC, project
transfer is only possible to the last connected device.
Comfort panels as of device version 13.0: Backing up data while loading projects
If the transfer is interrupted for Comfort Panels with a device version 13.0 or higher, WinCC
automatically ensures that no data is lost and that existing data is only deleted on the HMI
device after complete transmission.
Loading projects to a file

The "Load project to file" functionality is only available in Runtime Advanced devices with
version V13 or older.
Displaying characters in transfer alarms

If characters are not displayed correctly in the transfer alarms during transfers to HMI devices
with the device version V12 or older, please check the region and language settings in
Windows. Set the corresponding language under "Language for non-Unicode programs".
Reducing the project size

When compiling your HMI device, a message appears informing you that the size of your
project is approaching the system limits for the corresponding HMI device. In this case, perform
a complete compilation of the software to reduce the project size. To do this, use the command
"Compile > Software (rebuild all)".
See also
http://support.microsoft.com (http://support.microsoft.com/default.aspx?scid=kb;EN-US;
224305)
http://msdn.microsoft.com/en-us/library/ms968493.aspx (http://support.microsoft.com/
default.aspx?scid=kb;EN-US;224305)
Readme
65
WinCC Basic
3.8 Runtime
3.8
Runtime
3.8.1
Notes on operation in Runtime
Contents
product features.
Focus in runtime
If you have configured a low-contrast combination of focus color and border color in a V12
project, the focus may no longer be identifiable after changing the HMI device version in
Runtime. Change one of the two colors.
Language behavior - Layout of on-screen keyboard

The layout of the on-screen keyboard is not switched when the runtime language changes.
Tag values exceed the maximum length

You enter a character string in a string tag via an I/O field. If the character string exceeds the
configured number of tags, the character string will be shortened to the configured length.
Empty alarm texts

Runtime is running with a project. The project is saved on a network drive.
In the event of interruptions to the network drive connection, Runtime may attempt to load
alarm texts from the network drive.
In the event of disconnection, the alarm window or the alarm view remains empty.
To avoid this, copy the project to a local drive before the starting the project in Runtime.
Large logs delay the ending of Runtime (Basic Panels 2nd Generation)
When very large logs are used, ending Runtime can take a long time. Use segmented logs as
an alternative to very large circular logs.
Complete download in Service mode

If you need to perform a "complete download" to the OS in Service mode from the engineering
station, Runtime automatically stops and then starts again.
The project is then no longer in Service mode.
66
Readme
WinCC Basic
3.8 Runtime
In this state, the power supply is interrupted and WinCC Runtime no longer starts automatically
on the OS.
Remedy:
1. Switch the project manually to Service mode after you have performed the "complete
download".
2. Close the project manually.
3. Enable Service mode.
4. Start Runtime again using the surrogate icon in the taskbar.
Slow reaction of SmartServer

The following programs may start and respond very slowly under Windows 7 and Windows
2008 servers:
HMI TouchInputPC
SmartServer: <Ctrl+Alt+Del> shortcut in the logon dialog
The delay is caused by the callback for the Internet certificate validation.
Remedy:
You can find the following files
on the product DVD under:
Support\Windows7\CRL_Check or CD_RT\ Support\Windows7\CRL_Check\:
DisableCRLCheck_LocalSystem.cmd
DisableCRLCheck_CurrentUser.cmd
1. Run the "DisableCRLCheck_LocalSystem.cmd" file with administrator rights. Select the
command "Run as administrator" from the shortcut menu of the file.
2. Reboot the PC.
If the problem persists, follow these steps:
1. Double-click the file and run the "DisableCRLCheck_CurrentUser.cmd" file with user rights.
2. Reboot the PC.
Note
The callback for the certificate validation is disabled for all users or PCs. To restore the
original state, perform the following files:
RestoreDefaults_LocalSystem.cmd
RestoreDefaults_CurrentUser.cmd
You can find the files in the following directory of the product DVD:
Support\Windows7\CRL_Check or CD_RT\Support\Windows7\CRL_Check\
Readme
67
WinCC Basic
3.8 Runtime
Ending screensaver on the Sm@rtServer

When the screensaver is active on the Sm@rtServer on the server HMI device, you require
write access to the Sm@rtClient side in order to end the screen server on the server HMI
device.
Avoiding corrupt files during power failure

If a power failure occurs in Windows systems while the WinCC system is active, files may be
corrupt or destroyed. Operation with the NTFS file system provides better security.
Secure, continuous operation is only ensured by using an uninterruptible power supply (UPS).
3.8.2
Notes on operation of panels in Runtime
Contents
product features.
License transfer via S7USB

You always need to run WinCC to transfer a license to a panel via S7USB.
Using the mouse wheel in Runtime

The use of the mouse wheel in Runtime is not supported on all panels.
Basic Panels: Backup on the memory card of the PLC

Create the backup file "A.psb" on the memory card of the PLC. An error, for example a
connection break, occurs when creating the backup.
This will create a corrupt file on the memory card of the PLC. Such a file has "~$" as prefix.
Delete the file with the prefix "~$" if you want to save a backup again under the same name
"A.psb".
Basic Panels: Panel Data Storage and S7-1500F

The "Panel Data Storage" PDS function cannot be used on Basic Panels in conjunction with
S7-1500F when the password for the protection level "Full access incl. fail-safe" is used.
"Panel Data Storage" function on Basic Panels

The "Panel Data Storage" (PDS) function provided by Basic Panels is only supported by
SIMATIC S7-1200 as of firmware V4.0 and SIMATIC S7-1500. For the PDS function, the panel
must be connected directly with the CPU and must not be connected via the CP.
68
Readme
WinCC Basic
3.9 HMI devices
Fonts with file extension ".ttx"

The fonts with the file extension ".ttx" are available on all panels and Runtime Advanced and
can be correctly displayed on all devices, for example, the "WinCC_flexible_smart" font.
3.9
HMI devices
3.9.1
Notes on HMI devices
Contents
product features.
If the PC goes into standby or hibernate mode while the transfer is in progress, the panel status
after interruption of the transfer is not defined.
Multi-key operation
Unintentional actions can be triggered by multi-key operation:
When you are using a key device, you cannot press more than two function keys at the
same time.
When you are using a touch device, a standard PC or a panel PC, you can only press one
function key or button at the same time.
HMI devices with high communication load

S7 Diagnostics should be enabled if a Panel is assigned many connections to PLCs or other
HMI devices. Otherwise, you will risk overload on the Panel.
TS Adapter with Ethernet interface

If an HMI device is connected via Ethernet and a TS adapter, it can not be reset to factory
settings.
Simulation with real PLC connection

The access point used by the simulation is independent from the settings of the engineering
system and can only be altered in the Control Panel with the "Setting PG/PC Interface" tool.
If the PLC connection is terminated right after the start of the simulation with alarm 140001,
you should check the access point used by the simulation with "Setting PG/PC Interface".
1. Double-click "Setting PG/PC Interface" in the Control Panel. A dialog opens.
2. Select "S7ONLINE" in the "Access point of application" field as standard for HMI.
Readme
69
WinCC Basic
3.9 HMI devices
3. Select the interface in the "Interface Parameter Assignment Used" area.
4. Exit the dialog "Setting PG/PC Interface" with OK
Simulation of the Basic Panels

Use an output field in an alarm text to output an external tag. The content of the output field
will always be displayed with "0" during simulation.
Upgrading Basic Panels to device version V12

Before you upgrade Basic Panels from device version V11 to device version V12, transfer the
image of the V11 SP2 Update 5 or higher to the devices.
In the "SIMATIC ProSave [OS Update]" dialog, select the setting "Reset to factory settings".
In this way, you always start a functional update of the image.
Affected devices:
KP300 Basic mono PN
KP400 Basic color PN
KTP400 Basic color PN
Basic Panels 2nd Generation

Basic Panels 2nd Generation support the Sm@rtServer option.
If you are not using a USB hub, select the USB port USB_X60.1 as storage path.
HMI devices with operating system Windows CE 5.0 or higher

Owing to a modified client-server communication security setting, the time difference between
the HMI device (client) and PC (server) must not exceed 1 day. If you back up recipe data from
the HMI device on a network drive, for example, make sure that the time is set correctly on the
PC (server) and the HMI device (client).
Floating point numbers on MP 277, MP 377, TP 177B 4'' and CP4

Only floating point numbers in the range from 10-293 ... 10+307 are displayed correctly on the
HMI devices MP 277, MP 377, TP 177B 4'' and CP4. If the tag value is outside this range, it
is displayed as 0.
Restrictions for the HMI device, MP 377 15" Touch daylight readable
The following functions are not supported in WinCC V12 for the MP 377 15" Touch daylight
readable HMI device:
Option: Sm@rtServer
System function: SetAndGetBrightness
Direct keys
70
Readme
WinCC Basic
3.9 HMI devices
Connection switch in the Control Panel with Basic Panels

If you use the "Override protected connection information" function, the following restriction
applies:
You cannot perform a connection switch in the Control Panel of a Basic Panel from a PLC
without a protection level to a PLC with a "Complete protection" level.
Mobile Panel
Communication between fail-safe Mobile Panel and a S7-1200F is not possible with V14.0
and will not be enabled until a later update.
Mobile Panels 277F IWLAN

Mobile Panels 277F IWLAN are approved for use with CPUs of the type S7-1500F with WinCC
V13 SP1 Update 4.
If this connection is not established automatically after the panel is switched on or after a failsafe connection to a CPU S7-1500F is interrupted, a STOP/RUN transition needs to be
performed on the CPU.
Affected MLFBs:
6AV6645-0EB01-0AX1
6AV6645-0EC01-0AX1
6AV6645-0EF01-0AX1
6AV6645-0GB01-0AX1
6AV6645-0GC01-0AX1
6AV6645-0GF01-0AX1
Using Mobile Panel 277F IWLAN in the industrial environment

To avoid communication problems between the HMI device and access point, observe the
following:
IWLAN planning: Wireless connection between the HMI device and access point
Wireless field planning needs to be carried out. Radar influences need to be taken into
consideration for channels requiring Dynamic Frequency Selection (DFS).
Avoid radio frequency interference from other devices, such as hand-held devices with
Bluetooth or WLAN functionality.
For adjacent access points, use data channels that are separated by at least one wireless
channel (e.g. 36 and 44 rather than 36 and 40).
Do not place several access points in the immediately vicinity of one another. We
recommend a minimum distance of 5 m.
For the Mobile Panel 277F IWLAN, use the "Software retry number" 15 instead of the default
value 3.
Readme
71
WinCC Basic
3.9 HMI devices
Using the "Rapid roaming" function with iPCF-MC
Always use iPCF or iPCF-MC (rapid roaming) for PROFIsafe communication.
Use the same SSID for all access points.
The "Background scan" should be switched off on the HMI device ("Background scan
interval" for the HMI device = 1 (default value)).
Use the same "Management channel" and different, non-overlapping "Data channels" for
all access points.
Configure the "PN-IO cycle time" higher than the "iPCF scan cycle time".
Observe the configured timeout when assigning PROFIsafe parameters.
"Zone ID/Connection point ID" tag of a Mobile Panel 277 IWLAN V2

The tag used for the "Zone ID/Connection point ID" must be of data type INT for Mobile Panel
277 IWLAN V2 devices. Adapt this data type if necessary when migrating a project.
Mobile Panels 277F IWLAN (RFID tag): F_DB_STATES

The F_DB_STATES block is no longer supplied with WinCC V14. The block F_DB_STATES
serves only for data exchange. You can configure a block to replicate the function of the
F_DB_STATES, however. Note the description of the F_DB_STATES in the operating
instructions of your HMI device or in the information system.
IPC427D
If an IPC427D is configured in a V12 or V13 project in which IE1 of the PC station is assigned
and the device version of the PC station changes from V1 to V2 after upgrading to V14, the
interface assignment of CP_IE_1 must initially be set to "None, or different Windows settings"
and then changed to "SIMATIC PC Station" before compiling the project . Then, the project
can be compiled without errors.
Using PROFIsafe and Sm@rtServer with KTP700F Mobile and KTP900F Mobile Panels
The evaluation of the safety operation via PROFIsafe is only guaranteed if the Sm@rtServer
is disabled on the panel. Alternatively, the PROFINET cycle time can be increased to at least
128ms. This only affects the device version V14, not V13 SP1.
Printing alarms (Mobile Panels 2nd Generation)

It is not possible to print alarms as PDF or HTML when the internal memory "/flash" is selected
as "Storage Location". To print alarms as PDF or HTML, select an SD memory card or a USB
stick as storage location.
72
Readme
Index
.
.Net service packs, 5

.Net versions, 5
Go online
Multiple TIA Portal instances, 13
Asian, 5
Hardware
Detection, 20
C
Character string, 36
Characters, 5
Comparing library elements, 7
Compatibility, 13, 35
Conversions, 40
Convert character string, 36
CP 1613, 8
CP 1623, 8
CP 343-2, 15
CP 5512, 8
I
I/O, 29, 30
IE/PB Link, 16
IE/PB Link PN IO, 16
IP address, 8
ISO transport, 20
ISOonTCP, 20
K
K parameter, 37
D
Deactivate, 40
Decimal places, 6
DEMUX, 37
E
EC31-RTX, 15
ENO, 40
Ethernet module
Removal/insertion, 13
F
F-CM AS-i Safety ST, 16
Firmware loader Chinese GUI, 21
Firmware versions, 9
Force job on SD card, 7
Force table
Changed display formats, 30
Function value, 38
Readme
L
Library, 7
PLC data types generated by the system, 26
Loading
from a device, 13, 25
Module comments, 15
to the device, 13
M
Memory card, 7
Removal/insertion, 13
Migration of IP access protection lists when activating
Security, 22
Migration of projects with Ethernet CPs and
Security, 22
Module
Inserting, 13
Removing, 13
Module comments, 15
MRP domain, 19
73
Index
MRP role, 19
Multiple rings, 19
MUX, 37
N
Network, 24
Network drive, 6
O
Online connection
Multiple TIA Portal instances, 13
Online operation, 13
Open force job, 7
P
PLC data type
PLC data types generated by the system in
libraries, 26
PLC migration
Instruction profile, 13
PLCSIM, 24
Private Cloud, 9
Program_Alarm, 37
T
TiaDefaultProjectPath, 10
TiaUserSettingsPath, 10
Trace
Copy measurement, 20
Memory usage, 20
TSAP length, 20
U
USB card readers, 8
V
Virtual environment, 9
VMware - PC CPs, 21
W
Watch table
Changed display formats, 30
Loading data blocks during an active control
job, 29
Multiple access to the same CPU, 29
R
Return, 38
S
S_CONV, 36
S7 routing, 16, 20
via IE/PB Link, 16
S7-1200, 14
S7-1200 modules, 14
S7-Port Configuration Tool, 14
SD card, 7
Secure Open User Communication, 17
Security, 24
Security online diagnostics of S7 CPs, 22
SET, 36
SIMATIC S7 Embedded Controller, 15
Special diagnostics Chinese GUI, 21
STRING, 40
74
Readme

ReadMe STEP7 Professional V14 enUS PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

ReadMe STEP7 Professional V14 enUS PDF

Uploaded by

Copyright:

Available Formats

Readme

Programming and Operating Manual

Notes on the TIA Portal

Proper use of Siemens products

09/2016 Subject to change

Copyright Siemens AG 2016.

Notes on the TIA Portal................................................................................................................................5

Notes on memory cards...........................................................................................................7

Notes on the hardware configuration.......................................................................................8

Notes on using the TIA Portal in a virtual environment (private cloud)....................................9

Editing devices and networks.................................................................................................14

Inter Project Engineering (IPE)..............................................................................................40

SIMATIC STEP 7 PID Professional.......................................................................................48

Compiling and loading............................................................................................................64

Notes on the TIA Portal

Importing and exporting CAx data

Display of Asian characters in the TIA Portal

Installing new .Net versions or .Net service packs

Notes on the TIA Portal

Working with automatically synchronized network drives

Entry of decimal places

Information on the TIA Portal in online support

Notes on the TIA Portal

Starting the TIA Portal

Comparing library elements

Notes on memory cards

Notes on SIMATIC memory cards

Behavior in case of open force job

Notes on the TIA Portal

Access protection for memory cards in USB card readers

Notes on the hardware configuration

Subnet addressing for CP 1613 and CP 1623

Editing a device IP address

Drivers for the CP 5512 communications processor

Notes on the TIA Portal

Instructions not valid for all CPU firmware versions

Notes on using the TIA Portal in a virtual environment (private cloud)

Notes on the TIA Portal

Environment variables "TiaUserSettingsPath" and "TiaDefaultProjectPath"

Cross-domain HTTPS connections with the TIA Portal Cloud Connector

Comparing the configured and actual topology

This service provides the complete function

Communication to the S7 controller via

RFC 1006 102

The DCP protocol (Discovery and Basic

The SNMP client functionality is used by

* Default port that can be changed by user configuration

WinCC ES Basic (without simulation)

Transport pro Direction

This service provides the complete function

HMI Load (RT

This service is used to transmit images and

* Default port that can be changed by user configuration

Transport pro Direction

HMI Load (RT

This service is used to transmit images and

The Ethernet/IP protocol is used for connec

The Ethernet/IP protocol is used for connec

The Modbus TCP protocol is used for con

Communication to the S7 controller via

The Mitsubishi protocol is used for connec

Simultaneous online connections on an S7-1200 CPU

Removing/inserting the memory card